From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 68E7FC001DE for ; Wed, 19 Jul 2023 10:18:05 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender:List-Subscribe:List-Help :List-Post:List-Archive:List-Unsubscribe:List-Id:Content-Transfer-Encoding: Content-Type:In-Reply-To:From:References:Cc:To:Subject:MIME-Version:Date: Message-ID:Reply-To:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Owner; bh=/12YzBMxFEuL9z1yWxB+UUCkYX6+8C24FFiPRnVOeYs=; b=H1fApcZILlDh06ZjqHEqVT+/6x 7WAD4OONOt7lmFkpYK8ShWxBACkKJbBreMBhy1WB8YTfAd5x2R7RurMDq2ju11J59GSofkGttQjKT iMBEiNu3hfXhoein/RMt87I1sbjwak/CTYZ9ZWt1Oz12dV1RD58IQs3XSmOYUBJW86zrVaLoLd8CV 0F5m4rcJDKxThXfntQlbRqwFpR8AZ+7CZe6lnCM6TMkp0M0OQRiAUEW9BVoO89XPf8peq8FWZ/D9q S/XoNl8YkNmAQVm4zwX2hjCOlQEs/Tt++YegLiXObMeSPi8n3Q3+TsE3kC5QIND3iXnKXZSB3Cy2O kI2tqpTA==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.96 #2 (Red Hat Linux)) id 1qM4Fv-006fTn-1F; Wed, 19 Jul 2023 10:18:03 +0000 Received: from mail-wr1-x433.google.com ([2a00:1450:4864:20::433]) by bombadil.infradead.org with esmtps (Exim 4.96 #2 (Red Hat Linux)) id 1qM4Fr-006fSA-0M for linux-mediatek@lists.infradead.org; Wed, 19 Jul 2023 10:18:01 +0000 Received: by mail-wr1-x433.google.com with SMTP id ffacd0b85a97d-31716932093so860986f8f.3 for ; Wed, 19 Jul 2023 03:17:58 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=baylibre-com.20221208.gappssmtp.com; s=20221208; t=1689761877; x=1690366677; h=content-transfer-encoding:in-reply-to:from:content-language :references:cc:to:subject:user-agent:mime-version:date:message-id :from:to:cc:subject:date:message-id:reply-to; bh=/12YzBMxFEuL9z1yWxB+UUCkYX6+8C24FFiPRnVOeYs=; b=h7/WTUUWaoUzOcX86SFAvjDqKxEWUmwu+YhE3cNW33MrssWBI/fbZ8ND6zHNcXjHgw 3j8kn05JCeCAbnsife3MAC/9la+wF4PRffF+SRhL+G12LmogFN6K3TioSMpzkLm7KG93 gVjWA+5C6tI7mcjQ3QVMply/DRiEnOsagoTEPNoAP+HjDSt0XGtXBYMyYc8kkS5SjFn2 nB2tbt0lWG/K5JQ9lgxdCI1H3FEjIOWMaVhNMTK30fySlZYJmq8/VRj0ettvrI9n1cVJ cvsl4W62ZpzX+maxk5mts/VOjiWpHDL2RYFu0v2EkuRPhihuIY+rMNXsS+esJsloML/q a83A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20221208; t=1689761877; x=1690366677; h=content-transfer-encoding:in-reply-to:from:content-language :references:cc:to:subject:user-agent:mime-version:date:message-id :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=/12YzBMxFEuL9z1yWxB+UUCkYX6+8C24FFiPRnVOeYs=; b=b20NXi9VkQBEnFkMLcgB2l6Qk7z37J1raP1Ydt2JkS2n0plmL0BDoNWwrtmUH8TOjz /8D9B5Pluf2bIL0IZY0iNg+ERt7OSUBTq5jwf2tZp72U4305wDMF7XA+ubUdAvBVWRG1 sjLxjLNsJhCaUALmeIozVKHadSS78Zl8Gr/EZnFXoCxQ9V+NbLWyJVZ0zypx182rSq+o 3OyXE9PMVzp8IJIPA3kYz2lQpGZpy++H4V3ss/RbVVVuOjJA0RDI+EG2EbGqBSxk4Tr7 2qT8h4+ixM2XbX2e9VdcriSShQUQKLJpbCEpvO/MJZfnVDUtSsDfsYc/w3ulO7eJJAVr 2jbA== X-Gm-Message-State: ABy/qLaN4BZwamlHm+a4TMoe8sRnZRzju5eV/FfjhvPXktB0xULcUlBD CBcMhF4KyvJ9vg+TTQBzfB+4+A== X-Google-Smtp-Source: APBJJlH/wReuFNESBCfYGmjiyYJIozOQLKMrl6ckmaNf19lwjXmfAOVCoYhJvsQXenBPnI/4zc4muQ== X-Received: by 2002:adf:ecd0:0:b0:30f:ca58:a00d with SMTP id s16-20020adfecd0000000b0030fca58a00dmr1786141wro.45.1689761877016; Wed, 19 Jul 2023 03:17:57 -0700 (PDT) Received: from [192.168.1.172] ([93.5.22.158]) by smtp.gmail.com with ESMTPSA id j8-20020a5d4488000000b0031417b0d338sm4924130wrq.87.2023.07.19.03.17.55 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Wed, 19 Jul 2023 03:17:56 -0700 (PDT) Message-ID: <55c336a4-b268-d2d3-47f3-213300e4e623@baylibre.com> Date: Wed, 19 Jul 2023 12:17:55 +0200 MIME-Version: 1.0 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101 Thunderbird/102.13.0 Subject: Re: [RESEND PATCH v2] media: mtk-jpeg: Fix use after free bug due to uncanceled work To: Zheng Hacker Cc: Zheng Wang , Kyrie.Wu@mediatek.com, bin.liu@mediatek.com, mchehab@kernel.org, matthias.bgg@gmail.com, angelogioacchino.delregno@collabora.com, linux-media@vger.kernel.org, linux-kernel@vger.kernel.org, linux-arm-kernel@lists.infradead.org, linux-mediatek@lists.infradead.org, Irui.Wang@mediatek.com, security@kernel.org, 1395428693sheep@gmail.com, alex000young@gmail.com References: <20230707092414.866760-1-zyytlz.wz@163.com> <538096d2-7b24-e1c7-706d-4d4f952d35eb@baylibre.com> Content-Language: en-US From: Alexandre Mergnat In-Reply-To: Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 8bit X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20230719_031759_173021_810CB65C X-CRM114-Status: GOOD ( 11.64 ) X-BeenThere: linux-mediatek@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: "Linux-mediatek" Errors-To: linux-mediatek-bounces+linux-mediatek=archiver.kernel.org@lists.infradead.org On 18/07/2023 05:07, Zheng Hacker wrote: > Friendly ping > > Zheng Hacker 于2023年7月16日周日 00:08写道： >> >> Hi, >> >> This issue has not been resolved for a long time. Is there anyone who can help? >> >> Best regards, >> Zheng >> >> Alexandre Mergnat 于2023年7月7日周五 22:11写道： >>> >>> >>> >>> On 07/07/2023 11:24, Zheng Wang wrote: >>>> In mtk_jpeg_probe, &jpeg->job_timeout_work is bound with >>>> mtk_jpeg_job_timeout_work. Then mtk_jpeg_dec_device_run >>>> and mtk_jpeg_enc_device_run may be called to start the >>>> work. >>>> If we remove the module which will call mtk_jpeg_remove >>>> to make cleanup, there may be a unfinished work. The >>>> possible sequence is as follows, which will cause a >>>> typical UAF bug. >>>> >>>> Fix it by canceling the work before cleanup in the mtk_jpeg_remove >>>> >>>> CPU0 CPU1 >>>> >>>> |mtk_jpeg_job_timeout_work >>>> mtk_jpeg_remove | >>>> v4l2_m2m_release | >>>> kfree(m2m_dev); | >>>> | >>>> | v4l2_m2m_get_curr_priv >>>> | m2m_dev->curr_ctx //use >>> >>> Reviewed-by: Alexandre Mergnat >>> >>> -- >>> Regards, >>> Alexandre Hi Zheng, If you asking me to merge patch, sorry but I can't, I'm just a reviewer. I invite you to ping the maintainers directly: Bin Liu (supporter:MEDIATEK JPEG DRIVER) Mauro Carvalho Chehab (maintainer:MEDIA INPUT INFRASTRUCTURE (V4L/DVB)) Matthias Brugger (maintainer:ARM/Mediatek SoC support) Otherwise, I misunderstood what you asking me. If so, can you rephrase your question please? -- Regards, Alexandre From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 92891C001DC for ; Wed, 19 Jul 2023 10:18:19 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender:Content-Type: Content-Transfer-Encoding:List-Subscribe:List-Help:List-Post:List-Archive: List-Unsubscribe:List-Id:In-Reply-To:From:References:Cc:To:Subject: MIME-Version:Date:Message-ID:Reply-To:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: List-Owner; bh=aZL5+8zthLQ/E2Bf+7HU8TC6JVb/nCaRJ5J1eZJ/10k=; b=JztsgeAzpO+6V0 dOu3gK7CXWvS9TfdchPcbyq9Q2GAt7PjtoN/6o2KL0wdq9kKhiDC3CiJ5Y57K5afpDiLtqN1aDVEo 2OmpbkoYubPJtfEwNwaCeoXzMRTTP4YSxX/ku55jzqoJYSaZFPgLPrlxx+DVZllrsxgXNKhl3pnL+ 1Bd7EbV9IN5yiUFXP0IFDZTJA8Cf4aeCLVcnsX+dNHEc2a9UnUr99k2tXHI/ba6atvksIooHZyGWq MqWfa7r3z2aACYaKMy8dmJw+WOBWNnALfpuDt13aSebbxJe3SeiGFyImVA4wexKg4MgyB2xwgzcKg XEWDJ6dqTcYXsyHLyN/A==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.96 #2 (Red Hat Linux)) id 1qM4Fu-006fTa-2r; Wed, 19 Jul 2023 10:18:02 +0000 Received: from mail-wr1-x42c.google.com ([2a00:1450:4864:20::42c]) by bombadil.infradead.org with esmtps (Exim 4.96 #2 (Red Hat Linux)) id 1qM4Fr-006fSB-0g for linux-arm-kernel@lists.infradead.org; Wed, 19 Jul 2023 10:18:01 +0000 Received: by mail-wr1-x42c.google.com with SMTP id ffacd0b85a97d-316eabffaa6so5907906f8f.2 for ; Wed, 19 Jul 2023 03:17:58 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=baylibre-com.20221208.gappssmtp.com; s=20221208; t=1689761877; x=1690366677; h=content-transfer-encoding:in-reply-to:from:content-language :references:cc:to:subject:user-agent:mime-version:date:message-id :from:to:cc:subject:date:message-id:reply-to; bh=/12YzBMxFEuL9z1yWxB+UUCkYX6+8C24FFiPRnVOeYs=; b=h7/WTUUWaoUzOcX86SFAvjDqKxEWUmwu+YhE3cNW33MrssWBI/fbZ8ND6zHNcXjHgw 3j8kn05JCeCAbnsife3MAC/9la+wF4PRffF+SRhL+G12LmogFN6K3TioSMpzkLm7KG93 gVjWA+5C6tI7mcjQ3QVMply/DRiEnOsagoTEPNoAP+HjDSt0XGtXBYMyYc8kkS5SjFn2 nB2tbt0lWG/K5JQ9lgxdCI1H3FEjIOWMaVhNMTK30fySlZYJmq8/VRj0ettvrI9n1cVJ cvsl4W62ZpzX+maxk5mts/VOjiWpHDL2RYFu0v2EkuRPhihuIY+rMNXsS+esJsloML/q a83A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20221208; t=1689761877; x=1690366677; h=content-transfer-encoding:in-reply-to:from:content-language :references:cc:to:subject:user-agent:mime-version:date:message-id :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=/12YzBMxFEuL9z1yWxB+UUCkYX6+8C24FFiPRnVOeYs=; b=Ar2KTaDegvbhNax0+CM8MBITiNii936bJBSiHbZ3py47sAJ2YB5Uf42gD8P3qcQhUy BQw4O+vWHAo9s1z7P1adyG1l2CWaGy1258yu36MC+5pb+PG+bzQ68uNVOSzeJQMKG/R0 BQ5HLNdVSnUf0i1VBr9yqF0x+OEf2pJRPJv3kykfpZo5X0tYcpGyF5hezHdpmOny79FW GNRV4ioXxZ03LbmgAgfhDBpKbpetz8RDlwK9Bm5OCl4ST3NoTFBVTnwhNhaeklnIpKkU w4MIKCsxUPa0LQUeuejEB5Ea6bRbCYCbeZN4X0a4WPjh0qKnaMBH4tObXAmuaBThQbCd In9A== X-Gm-Message-State: ABy/qLZfplsF33oQ6BJ0SnAQhT/f8vjYOpDoATZJ/Mv2wU5cFcfwINEw y3JNSSeGjQ+h9f+oDZlpBktw7Q== X-Google-Smtp-Source: APBJJlH/wReuFNESBCfYGmjiyYJIozOQLKMrl6ckmaNf19lwjXmfAOVCoYhJvsQXenBPnI/4zc4muQ== X-Received: by 2002:adf:ecd0:0:b0:30f:ca58:a00d with SMTP id s16-20020adfecd0000000b0030fca58a00dmr1786141wro.45.1689761877016; Wed, 19 Jul 2023 03:17:57 -0700 (PDT) Received: from [192.168.1.172] ([93.5.22.158]) by smtp.gmail.com with ESMTPSA id j8-20020a5d4488000000b0031417b0d338sm4924130wrq.87.2023.07.19.03.17.55 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Wed, 19 Jul 2023 03:17:56 -0700 (PDT) Message-ID: <55c336a4-b268-d2d3-47f3-213300e4e623@baylibre.com> Date: Wed, 19 Jul 2023 12:17:55 +0200 MIME-Version: 1.0 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101 Thunderbird/102.13.0 Subject: Re: [RESEND PATCH v2] media: mtk-jpeg: Fix use after free bug due to uncanceled work To: Zheng Hacker Cc: Zheng Wang , Kyrie.Wu@mediatek.com, bin.liu@mediatek.com, mchehab@kernel.org, matthias.bgg@gmail.com, angelogioacchino.delregno@collabora.com, linux-media@vger.kernel.org, linux-kernel@vger.kernel.org, linux-arm-kernel@lists.infradead.org, linux-mediatek@lists.infradead.org, Irui.Wang@mediatek.com, security@kernel.org, 1395428693sheep@gmail.com, alex000young@gmail.com References: <20230707092414.866760-1-zyytlz.wz@163.com> <538096d2-7b24-e1c7-706d-4d4f952d35eb@baylibre.com> Content-Language: en-US From: Alexandre Mergnat In-Reply-To: X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20230719_031759_255847_1830770A X-CRM114-Status: GOOD ( 12.85 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Transfer-Encoding: base64 Content-Type: text/plain; charset="utf-8"; Format="flowed" Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org CgpPbiAxOC8wNy8yMDIzIDA1OjA3LCBaaGVuZyBIYWNrZXIgd3JvdGU6Cj4gRnJpZW5kbHkgcGlu Zwo+IAo+IFpoZW5nIEhhY2tlciA8aGFja2Vyemhlbmc2NjZAZ21haWwuY29tPiDkuo4yMDIz5bm0 N+aciDE25pel5ZGo5pelIDAwOjA45YaZ6YGT77yaCj4+Cj4+IEhpLAo+Pgo+PiBUaGlzIGlzc3Vl IGhhcyBub3QgYmVlbiByZXNvbHZlZCBmb3IgYSBsb25nIHRpbWUuIElzIHRoZXJlIGFueW9uZSB3 aG8gY2FuIGhlbHA/Cj4+Cj4+IEJlc3QgcmVnYXJkcywKPj4gWmhlbmcKPj4KPj4gQWxleGFuZHJl IE1lcmduYXQgPGFtZXJnbmF0QGJheWxpYnJlLmNvbT4g5LqOMjAyM+W5tDfmnIg35pel5ZGo5LqU IDIyOjEx5YaZ6YGT77yaCj4+Pgo+Pj4KPj4+Cj4+PiBPbiAwNy8wNy8yMDIzIDExOjI0LCBaaGVu ZyBXYW5nIHdyb3RlOgo+Pj4+IEluIG10a19qcGVnX3Byb2JlLCAmanBlZy0+am9iX3RpbWVvdXRf d29yayBpcyBib3VuZCB3aXRoCj4+Pj4gbXRrX2pwZWdfam9iX3RpbWVvdXRfd29yay4gVGhlbiBt dGtfanBlZ19kZWNfZGV2aWNlX3J1bgo+Pj4+IGFuZCBtdGtfanBlZ19lbmNfZGV2aWNlX3J1biBt YXkgYmUgY2FsbGVkIHRvIHN0YXJ0IHRoZQo+Pj4+IHdvcmsuCj4+Pj4gSWYgd2UgcmVtb3ZlIHRo ZSBtb2R1bGUgd2hpY2ggd2lsbCBjYWxsIG10a19qcGVnX3JlbW92ZQo+Pj4+IHRvIG1ha2UgY2xl YW51cCwgdGhlcmUgbWF5IGJlIGEgdW5maW5pc2hlZCB3b3JrLiBUaGUKPj4+PiBwb3NzaWJsZSBz ZXF1ZW5jZSBpcyBhcyBmb2xsb3dzLCB3aGljaCB3aWxsIGNhdXNlIGEKPj4+PiB0eXBpY2FsIFVB RiBidWcuCj4+Pj4KPj4+PiBGaXggaXQgYnkgY2FuY2VsaW5nIHRoZSB3b3JrIGJlZm9yZSBjbGVh bnVwIGluIHRoZSBtdGtfanBlZ19yZW1vdmUKPj4+Pgo+Pj4+IENQVTAgICAgICAgICAgICAgICAg ICBDUFUxCj4+Pj4KPj4+PiAgICAgICAgICAgICAgICAgICAgICAgfG10a19qcGVnX2pvYl90aW1l b3V0X3dvcmsKPj4+PiBtdGtfanBlZ19yZW1vdmUgICAgIHwKPj4+PiAgICAgdjRsMl9tMm1fcmVs ZWFzZSAgfAo+Pj4+ICAgICAgIGtmcmVlKG0ybV9kZXYpOyB8Cj4+Pj4gICAgICAgICAgICAgICAg ICAgICAgIHwKPj4+PiAgICAgICAgICAgICAgICAgICAgICAgfCB2NGwyX20ybV9nZXRfY3Vycl9w cml2Cj4+Pj4gICAgICAgICAgICAgICAgICAgICAgIHwgICBtMm1fZGV2LT5jdXJyX2N0eCAvL3Vz ZQo+Pj4KPj4+IFJldmlld2VkLWJ5OiBBbGV4YW5kcmUgTWVyZ25hdCA8YW1lcmduYXRAYmF5bGli cmUuY29tPgo+Pj4KPj4+IC0tCj4+PiBSZWdhcmRzLAo+Pj4gQWxleGFuZHJlCgpIaSBaaGVuZywK CklmIHlvdSBhc2tpbmcgbWUgdG8gbWVyZ2UgcGF0Y2gsIHNvcnJ5IGJ1dCBJIGNhbid0LCBJJ20g anVzdCBhIHJldmlld2VyLiAKSSBpbnZpdGUgeW91IHRvIHBpbmcgdGhlIG1haW50YWluZXJzIGRp cmVjdGx5OgoKQmluIExpdSA8YmluLmxpdUBtZWRpYXRlay5jb20+IChzdXBwb3J0ZXI6TUVESUFU RUsgSlBFRyBEUklWRVIpCk1hdXJvIENhcnZhbGhvIENoZWhhYiA8bWNoZWhhYkBrZXJuZWwub3Jn PiAobWFpbnRhaW5lcjpNRURJQSBJTlBVVCAKSU5GUkFTVFJVQ1RVUkUgKFY0TC9EVkIpKQpNYXR0 aGlhcyBCcnVnZ2VyIDxtYXR0aGlhcy5iZ2dAZ21haWwuY29tPiAobWFpbnRhaW5lcjpBUk0vTWVk aWF0ZWsgU29DIApzdXBwb3J0KQoKT3RoZXJ3aXNlLCBJIG1pc3VuZGVyc3Rvb2Qgd2hhdCB5b3Ug YXNraW5nIG1lLiBJZiBzbywgY2FuIHlvdSByZXBocmFzZSAKeW91ciBxdWVzdGlvbiBwbGVhc2U/ CgotLSAKUmVnYXJkcywKQWxleGFuZHJlCgpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fXwpsaW51eC1hcm0ta2VybmVsIG1haWxpbmcgbGlzdApsaW51eC1hcm0t a2VybmVsQGxpc3RzLmluZnJhZGVhZC5vcmcKaHR0cDovL2xpc3RzLmluZnJhZGVhZC5vcmcvbWFp bG1hbi9saXN0aW5mby9saW51eC1hcm0ta2VybmVsCg==