提交 cc4a8258 编写于 作者: M Mauro Carvalho Chehab

[media] media-entity: cache media_device on object removal

As pointed by Dan, the commit f8fd4c61b5ae ("[media] media-entity:
protect object creation/removal using spin lock")' leads to the
following static checker warning:

	drivers/media/media-entity.c:781 media_remove_intf_link()
	error: dereferencing freed memory 'link'

drivers/media/media-entity.c
   777  void media_remove_intf_link(struct media_link *link)
   778  {
   779          spin_lock(&link->graph_obj.mdev->lock);
   780          __media_remove_intf_link(link);
   781          spin_unlock(&link->graph_obj.mdev->lock);

In practice, I didn't see any troubles even with KASAN enabled. I guess
gcc optimizer internally cached the mdev reference, instead of getting
it twice. Yet, it is a very bad idea to rely on such optimization. So,
let's fix the code.
Reported-by: NDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@osg.samsung.com>
上级 5c883edb
...@@ -580,13 +580,15 @@ EXPORT_SYMBOL_GPL(__media_entity_remove_links); ...@@ -580,13 +580,15 @@ EXPORT_SYMBOL_GPL(__media_entity_remove_links);
void media_entity_remove_links(struct media_entity *entity) void media_entity_remove_links(struct media_entity *entity)
{ {
struct media_device *mdev = entity->graph_obj.mdev;
/* Do nothing if the entity is not registered. */ /* Do nothing if the entity is not registered. */
if (entity->graph_obj.mdev == NULL) if (mdev == NULL)
return; return;
spin_lock(&entity->graph_obj.mdev->lock); spin_lock(&mdev->lock);
__media_entity_remove_links(entity); __media_entity_remove_links(entity);
spin_unlock(&entity->graph_obj.mdev->lock); spin_unlock(&mdev->lock);
} }
EXPORT_SYMBOL_GPL(media_entity_remove_links); EXPORT_SYMBOL_GPL(media_entity_remove_links);
...@@ -781,9 +783,15 @@ EXPORT_SYMBOL_GPL(__media_remove_intf_link); ...@@ -781,9 +783,15 @@ EXPORT_SYMBOL_GPL(__media_remove_intf_link);
void media_remove_intf_link(struct media_link *link) void media_remove_intf_link(struct media_link *link)
{ {
spin_lock(&link->graph_obj.mdev->lock); struct media_device *mdev = link->graph_obj.mdev;
/* Do nothing if the intf is not registered. */
if (mdev == NULL)
return;
spin_lock(&mdev->lock);
__media_remove_intf_link(link); __media_remove_intf_link(link);
spin_unlock(&link->graph_obj.mdev->lock); spin_unlock(&mdev->lock);
} }
EXPORT_SYMBOL_GPL(media_remove_intf_link); EXPORT_SYMBOL_GPL(media_remove_intf_link);
...@@ -799,12 +807,14 @@ EXPORT_SYMBOL_GPL(__media_remove_intf_links); ...@@ -799,12 +807,14 @@ EXPORT_SYMBOL_GPL(__media_remove_intf_links);
void media_remove_intf_links(struct media_interface *intf) void media_remove_intf_links(struct media_interface *intf)
{ {
struct media_device *mdev = intf->graph_obj.mdev;
/* Do nothing if the intf is not registered. */ /* Do nothing if the intf is not registered. */
if (intf->graph_obj.mdev == NULL) if (mdev == NULL)
return; return;
spin_lock(&intf->graph_obj.mdev->lock); spin_lock(&mdev->lock);
__media_remove_intf_links(intf); __media_remove_intf_links(intf);
spin_unlock(&intf->graph_obj.mdev->lock); spin_unlock(&mdev->lock);
} }
EXPORT_SYMBOL_GPL(media_remove_intf_links); EXPORT_SYMBOL_GPL(media_remove_intf_links);
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册