media: staging: lirc_zilog: incorrect reference counting
[not upstream as the driver is deleted in 4.16 - gregkh]
Whenever poll is called, the reference count is increased but never
decreased. This means that on rmmod, the lirc_thread is not stopped,
and will trample over freed memory.
Zilog/Hauppauge IR driver unloaded
BUG: unable to handle kernel paging request at
ffffffffc17ba640
Oops: 0010 [#1] SMP
CPU: 1 PID: 667 Comm: zilog-rx-i2c-1 Tainted: P C OE 4.13.16-302.fc27.x86_64 #1
Hardware name: Gigabyte Technology Co., Ltd. GA-MA790FXT-UD5P/GA-MA790FXT-UD5P, BIOS F6 08/06/2009
task:
ffff964eb452ca00 task.stack:
ffffb254414dc000
RIP: 0010:0xffffffffc17ba640
RSP: 0018:
ffffb254414dfe78 EFLAGS:
00010286
RAX:
0000000000000000 RBX:
ffff964ec1b35890 RCX:
0000000000000000
RDX:
0000000000000000 RSI:
0000000000000246 RDI:
0000000000000246
RBP:
ffffb254414dff00 R08:
000000000000036e R09:
ffff964ecfc8dfd0
R10:
ffffb254414dfe78 R11:
00000000000f4240 R12:
ffff964ec2bf28a0
R13:
ffff964ec1b358a8 R14:
ffff964ec1b358d0 R15:
ffff964ec1b35800
FS:
0000000000000000(0000) GS:
ffff964ecfc80000(0000) knlGS:
0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0:
0000000080050033
CR2:
ffffffffc17ba640 CR3:
000000023058c000 CR4:
00000000000006e0
Call Trace:
kthread+0x125/0x140
? kthread_park+0x60/0x60
? do_syscall_64+0x67/0x140
ret_from_fork+0x25/0x30
Code: Bad RIP value.
RIP: 0xffffffffc17ba640 RSP:
ffffb254414dfe78
CR2:
ffffffffc17ba640
Note that zilog-rx-i2c-1 should have exited by now, but hasn't due to
the missing put in poll().
This code has been replaced completely in kernel v4.16 by a new driver,
see commit
acaa34bf06e9 ("media: rc: implement zilog transmitter"), and
commit
f95367a7b758 ("media: staging: remove lirc_zilog driver").
Cc: stable@vger.kernel.org # v4.15- (all up to and including v4.15)
Reported-by: Warren Sturm <warren.sturm@gmail.com>
Tested-by: Warren Sturm <warren.sturm@gmail.com>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>