[PATCH] media: cedrus: fix use after free bug in cedrus_remove due to race condition
From: Zheng Wang <hidden>
Date: 2023-03-08 03:24:31
Also in:
linux-media, linux-staging, linux-sunxi, lkml
Subsystem:
allwinner vpu driver, media input infrastructure (v4l/dvb), staging subsystem, the rest · Maintainers:
Maxime Ripard, Paul Kocialkowski, Mauro Carvalho Chehab, Greg Kroah-Hartman, Linus Torvalds
In cedrus_probe, dev->watchdog_work is bound with cedrus_watchdog function.
In cedrus_device_run, it will started by schedule_delayed_work. If there is
unfinished work in cedrus_remove, there may be a race condition and trigger
UAF bug.
CPU0 CPU1
|cedrus_watchdog
cedrus_remove |
v4l2_m2m_release |
kfree(m2m_dev) |
|
| v4l2_m2m_get_curr_priv
| m2m_dev //use
Fix it by canceling the worker in cedrus_remove.
Signed-off-by: Zheng Wang <redacted>
---
drivers/staging/media/sunxi/cedrus/cedrus.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/staging/media/sunxi/cedrus/cedrus.c b/drivers/staging/media/sunxi/cedrus/cedrus.c
index a43d5ff66716..c95d011c0817 100644
--- a/drivers/staging/media/sunxi/cedrus/cedrus.c
+++ b/drivers/staging/media/sunxi/cedrus/cedrus.c@@ -546,7 +546,7 @@ static int cedrus_probe(struct platform_device *pdev) static int cedrus_remove(struct platform_device *pdev) { struct cedrus_dev *dev = platform_get_drvdata(pdev); - + cancel_delayed_work(&dev->watchdog_work); if (media_devnode_is_registered(dev->mdev.devnode)) { media_device_unregister(&dev->mdev); v4l2_m2m_unregister_media_controller(dev->m2m_dev);
--
2.25.1
_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel