[SRU][J][PATCH 1/1] media: i2c: et8ek8: Don't strip remove function when driver is builtin

Hui Wang hui.wang at canonical.com
Wed Sep 18 05:56:53 UTC 2024


From: Uwe Kleine-König <u.kleine-koenig at pengutronix.de>

Using __exit for the remove function results in the remove callback
being discarded with CONFIG_VIDEO_ET8EK8=y. When such a device gets
unbound (e.g. using sysfs or hotplug), the driver is just removed
without the cleanup being performed. This results in resource leaks. Fix
it by compiling in the remove callback unconditionally.

This also fixes a W=1 modpost warning:

	WARNING: modpost: drivers/media/i2c/et8ek8/et8ek8: section mismatch in reference: et8ek8_i2c_driver+0x10 (section: .data) -> et8ek8_remove (section: .exit.text)

Fixes: c5254e72b8ed ("[media] media: Driver for Toshiba et8ek8 5MP sensor")
Signed-off-by: Uwe Kleine-König <u.kleine-koenig at pengutronix.de>
Signed-off-by: Sakari Ailus <sakari.ailus at linux.intel.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco at xs4all.nl>
(backported from commit 545b215736c5c4b354e182d99c578a472ac9bfce)
[hui: This backport adjusts context due to 2 conflict, the 1st one is
the return type of et8ek8_remove(), in J and F, the return type is int
while in original commit the return type is void, here I kept the
return type to int; the other one is probe function type, in the J and
F, it is probe_new, in the original commit, it is probe, here I kept
probe_new since it is unrelevant to this CVE case.]
CVE-2024-38611
Signed-off-by: Hui Wang <hui.wang at canonical.com>
---
 drivers/media/i2c/et8ek8/et8ek8_driver.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/media/i2c/et8ek8/et8ek8_driver.c b/drivers/media/i2c/et8ek8/et8ek8_driver.c
index 873d614339bbb..2910842705bc1 100644
--- a/drivers/media/i2c/et8ek8/et8ek8_driver.c
+++ b/drivers/media/i2c/et8ek8/et8ek8_driver.c
@@ -1460,7 +1460,7 @@ static int et8ek8_probe(struct i2c_client *client)
 	return ret;
 }
 
-static int __exit et8ek8_remove(struct i2c_client *client)
+static int et8ek8_remove(struct i2c_client *client)
 {
 	struct v4l2_subdev *subdev = i2c_get_clientdata(client);
 	struct et8ek8_sensor *sensor = to_et8ek8_sensor(subdev);
@@ -1504,7 +1504,7 @@ static struct i2c_driver et8ek8_i2c_driver = {
 		.of_match_table	= et8ek8_of_table,
 	},
 	.probe_new	= et8ek8_probe,
-	.remove		= __exit_p(et8ek8_remove),
+	.remove		= et8ek8_remove,
 	.id_table	= et8ek8_id_table,
 };
 
-- 
2.34.1




More information about the kernel-team mailing list