From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Lv Yunlong <lyl2019@mail.ustc.edu.cn>,
Hans Verkuil <hverkuil-cisco@xs4all.nl>,
Mauro Carvalho Chehab <mchehab+huawei@kernel.org>,
Sasha Levin <sashal@kernel.org>,
linux-media@vger.kernel.org
Subject: [PATCH AUTOSEL 4.19 17/31] media: v4l2-core: Avoid the dangling pointer in v4l2_fh_release
Date: Sun, 4 Jul 2021 19:10:29 -0400 [thread overview]
Message-ID: <20210704231043.1491209-17-sashal@kernel.org> (raw)
In-Reply-To: <20210704231043.1491209-1-sashal@kernel.org>
From: Lv Yunlong <lyl2019@mail.ustc.edu.cn>
[ Upstream commit 7dd0c9e547b6924e18712b6b51aa3cba1896ee2c ]
A use after free bug caused by the dangling pointer
filp->privitate_data in v4l2_fh_release.
See https://lore.kernel.org/patchwork/patch/1419058/.
My patch sets the dangling pointer to NULL to provide
robust.
Signed-off-by: Lv Yunlong <lyl2019@mail.ustc.edu.cn>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/v4l2-core/v4l2-fh.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/media/v4l2-core/v4l2-fh.c b/drivers/media/v4l2-core/v4l2-fh.c
index c91a7bd3ecfc..ac8282d059fc 100644
--- a/drivers/media/v4l2-core/v4l2-fh.c
+++ b/drivers/media/v4l2-core/v4l2-fh.c
@@ -104,6 +104,7 @@ int v4l2_fh_release(struct file *filp)
v4l2_fh_del(fh);
v4l2_fh_exit(fh);
kfree(fh);
+ filp->private_data = NULL;
}
return 0;
}
--
2.30.2
next prev parent reply other threads:[~2021-07-04 23:13 UTC|newest]
Thread overview: 34+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-07-04 23:10 [PATCH AUTOSEL 4.19 01/31] spi: Make of_register_spi_device also set the fwnode Sasha Levin
2021-07-04 23:10 ` [PATCH AUTOSEL 4.19 02/31] media: s5p: fix pm_runtime_get_sync() usage count Sasha Levin
2021-07-04 23:10 ` [PATCH AUTOSEL 4.19 03/31] media: sh_vou: " Sasha Levin
2021-07-04 23:10 ` [PATCH AUTOSEL 4.19 04/31] media: sti/bdisp: " Sasha Levin
2021-07-04 23:10 ` [PATCH AUTOSEL 4.19 05/31] spi: spi-loopback-test: Fix 'tx_buf' might be 'rx_buf' Sasha Levin
2021-07-04 23:10 ` [PATCH AUTOSEL 4.19 06/31] spi: spi-topcliff-pch: Fix potential double free in pch_spi_process_messages() Sasha Levin
2021-07-04 23:10 ` [PATCH AUTOSEL 4.19 07/31] spi: omap-100k: Fix the length judgment problem Sasha Levin
2021-07-04 23:10 ` [PATCH AUTOSEL 4.19 08/31] regulator: uniphier: Add missing MODULE_DEVICE_TABLE Sasha Levin
2021-07-04 23:10 ` Sasha Levin
2021-07-04 23:10 ` [PATCH AUTOSEL 4.19 09/31] crypto: nx - add " Sasha Levin
2021-07-04 23:10 ` Sasha Levin
2021-07-04 23:10 ` [PATCH AUTOSEL 4.19 10/31] media: cpia2: fix memory leak in cpia2_usb_probe Sasha Levin
2021-07-04 23:10 ` [PATCH AUTOSEL 4.19 11/31] media: cobalt: fix race condition in setting HPD Sasha Levin
2021-07-04 23:10 ` [PATCH AUTOSEL 4.19 12/31] media: pvrusb2: fix warning in pvr2_i2c_core_done Sasha Levin
2021-07-04 23:10 ` [PATCH AUTOSEL 4.19 13/31] crypto: qat - check return code of qat_hal_rd_rel_reg() Sasha Levin
2021-07-04 23:10 ` [PATCH AUTOSEL 4.19 14/31] crypto: qat - remove unused macro in FW loader Sasha Levin
2021-07-04 23:10 ` [PATCH AUTOSEL 4.19 15/31] sched/fair: Fix ascii art by relpacing tabs Sasha Levin
2021-07-04 23:10 ` [PATCH AUTOSEL 4.19 16/31] media: em28xx: Fix possible memory leak of em28xx struct Sasha Levin
2021-07-04 23:10 ` Sasha Levin [this message]
2021-07-04 23:10 ` [PATCH AUTOSEL 4.19 18/31] media: bt8xx: Fix a missing check bug in bt878_probe Sasha Levin
2021-07-04 23:10 ` [PATCH AUTOSEL 4.19 19/31] media: st-hva: Fix potential NULL pointer dereferences Sasha Levin
2021-07-04 23:10 ` [PATCH AUTOSEL 4.19 20/31] media: dvd_usb: memory leak in cinergyt2_fe_attach Sasha Levin
2021-07-04 23:10 ` [PATCH AUTOSEL 4.19 21/31] mmc: via-sdmmc: add a check against NULL pointer dereference Sasha Levin
2021-07-04 23:10 ` [PATCH AUTOSEL 4.19 22/31] crypto: shash - avoid comparing pointers to exported functions under CFI Sasha Levin
2021-07-04 23:10 ` [PATCH AUTOSEL 4.19 23/31] media: dvb_net: avoid speculation from net slot Sasha Levin
2021-07-04 23:10 ` [PATCH AUTOSEL 4.19 24/31] media: siano: fix device register error path Sasha Levin
2021-07-04 23:10 ` [PATCH AUTOSEL 4.19 25/31] media: imx-csi: Skip first few frames from a BT.656 source Sasha Levin
2021-07-04 23:10 ` Sasha Levin
2021-07-04 23:10 ` [PATCH AUTOSEL 4.19 26/31] btrfs: fix error handling in __btrfs_update_delayed_inode Sasha Levin
2021-07-04 23:10 ` [PATCH AUTOSEL 4.19 27/31] btrfs: abort transaction if we fail to update the delayed inode Sasha Levin
2021-07-04 23:10 ` [PATCH AUTOSEL 4.19 28/31] btrfs: make Private2 lifespan more consistent Sasha Levin
2021-07-04 23:10 ` [PATCH AUTOSEL 4.19 29/31] btrfs: fix the filemap_range_has_page() call in btrfs_punch_hole_lock_range() Sasha Levin
2021-07-04 23:10 ` [PATCH AUTOSEL 4.19 30/31] btrfs: disable build on platforms having page size 256K Sasha Levin
2021-07-04 23:10 ` [PATCH AUTOSEL 4.19 31/31] regulator: da9052: Ensure enough delay time for .set_voltage_time_sel Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210704231043.1491209-17-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=hverkuil-cisco@xs4all.nl \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-media@vger.kernel.org \
--cc=lyl2019@mail.ustc.edu.cn \
--cc=mchehab+huawei@kernel.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.