shinys000114/linux
1
0
Fork 0
mirror of https://github.com/hardkernel/linux.git synced 2026-06-06 02:50:49 +09:00
Code Issues Packages Projects Releases Wiki Activity

media: saa7134: fix use after free bug in saa7134_finidev due to race condition

Browse Source 
[ Upstream commit 30cf57da17 ]

In saa7134_initdev, it will call saa7134_hwinit1. There are three
function invoking here: saa7134_video_init1, saa7134_ts_init1
and saa7134_vbi_init1.

All of them will init a timer with same function. Take
saa7134_video_init1 as an example. It'll bound &dev->video_q.timeout
with saa7134_buffer_timeout.

In buffer_activate, the timer funtcion is started.

If we remove the module or device which will call saa7134_finidev
to make cleanup, there may be a unfinished work. The
possible sequence is as follows, which will cause a
typical UAF bug.

Fix it by canceling the timer works accordingly before cleanup in
saa7134_finidev.

CPU0                  CPU1

                    |saa7134_buffer_timeout
saa7134_finidev     |
  kfree(dev);       |
                    |
                    | saa7134_buffer_next
                    | //use dev

Fixes: 1e7126b4a8 ("media: saa7134: Convert timers to use timer_setup()")
Signed-off-by: Zheng Wang <zyytlz.wz@163.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
Zheng Wang
2023-03-18 16:50:23 +08:00
committed by Greg Kroah-Hartman
parent 305262a23c
commit 5a72aea9ac
3 changed files with 3 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
drivers/media/pci/saa7134/saa7134-ts.c
View File

@@ -300,6 +300,7 @@ int saa7134_ts_start(struct saa7134_dev *dev)
int saa7134_ts_fini(struct saa7134_dev *dev) int saa7134_ts_fini(struct saa7134_dev *dev)
{ {
del_timer_sync(&dev->ts_q.timeout);
saa7134_pgtable_free(dev->pci, &dev->ts_q.pt); saa7134_pgtable_free(dev->pci, &dev->ts_q.pt);
return 0; return 0;
} }

1
drivers/media/pci/saa7134/saa7134-vbi.c
View File

@@ -185,6 +185,7 @@ int saa7134_vbi_init1(struct saa7134_dev *dev)
int saa7134_vbi_fini(struct saa7134_dev *dev) int saa7134_vbi_fini(struct saa7134_dev *dev)
{ {
/* nothing */ /* nothing */
del_timer_sync(&dev->vbi_q.timeout);
return 0; return 0;
} }

1
drivers/media/pci/saa7134/saa7134-video.c
View File

@@ -2146,6 +2146,7 @@ int saa7134_video_init1(struct saa7134_dev *dev)
void saa7134_video_fini(struct saa7134_dev *dev) void saa7134_video_fini(struct saa7134_dev *dev)
{ {
del_timer_sync(&dev->video_q.timeout);
/* free stuff */ /* free stuff */
saa7134_pgtable_free(dev->pci, &dev->video_q.pt); saa7134_pgtable_free(dev->pci, &dev->video_q.pt);
saa7134_pgtable_free(dev->pci, &dev->vbi_q.pt); saa7134_pgtable_free(dev->pci, &dev->vbi_q.pt);