Skip to content

Commit a9711f6

Browse files
Uwe Kleine-Königsmb49
authored andcommitted
media: i2c: et8ek8: Don't strip remove function when driver is builtin
Using __exit for the remove function results in the remove callback being discarded with CONFIG_VIDEO_ET8EK8=y. When such a device gets unbound (e.g. using sysfs or hotplug), the driver is just removed without the cleanup being performed. This results in resource leaks. Fix it by compiling in the remove callback unconditionally. This also fixes a W=1 modpost warning: WARNING: modpost: drivers/media/i2c/et8ek8/et8ek8: section mismatch in reference: et8ek8_i2c_driver+0x10 (section: .data) -> et8ek8_remove (section: .exit.text) Fixes: c5254e7 ("[media] media: Driver for Toshiba et8ek8 5MP sensor") Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de> Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> CVE-2024-38611 (backported from commit 545b215736c5c4b354e182d99c578a472ac9bfce) [hui: This backport adjusts context due to 2 conflict, the 1st one is the return type of et8ek8_remove(), in J and F, the return type is int while in original commit the return type is void, here I kept the return type to int; the other one is probe function type, in the J and F, it is probe_new, in the original commit, it is probe, here I kept probe_new since it is unrelevant to this CVE case.] Signed-off-by: Hui Wang <hui.wang@canonical.com> Acked-by: Koichiro Den <koichiro.den@canonical.com> Acked-by: Mehmet Basaran <mehmet.basaran@canonical.com> Signed-off-by: Stefan Bader <stefan.bader@canonical.com>
1 parent 1caf1dd commit a9711f6

File tree

1 file changed

+2
-2
lines changed

1 file changed

+2
-2
lines changed

drivers/media/i2c/et8ek8/et8ek8_driver.c

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1460,7 +1460,7 @@ static int et8ek8_probe(struct i2c_client *client)
14601460
return ret;
14611461
}
14621462

1463-
static int __exit et8ek8_remove(struct i2c_client *client)
1463+
static int et8ek8_remove(struct i2c_client *client)
14641464
{
14651465
struct v4l2_subdev *subdev = i2c_get_clientdata(client);
14661466
struct et8ek8_sensor *sensor = to_et8ek8_sensor(subdev);
@@ -1504,7 +1504,7 @@ static struct i2c_driver et8ek8_i2c_driver = {
15041504
.of_match_table = et8ek8_of_table,
15051505
},
15061506
.probe_new = et8ek8_probe,
1507-
.remove = __exit_p(et8ek8_remove),
1507+
.remove = et8ek8_remove,
15081508
.id_table = et8ek8_id_table,
15091509
};
15101510

0 commit comments

Comments
 (0)