From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 41989EE6459 for ; Fri, 15 Sep 2023 11:41:48 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:MIME-Version:Message-Id:Date:Subject:Cc :To:From:Reply-To:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References: List-Owner; bh=7mY8ahUT31ri3bk3eyaQlyF+3axLz8VCbP1LqBiD4bo=; b=pgaO9alarXwBqo AL+0S4Yy243BPgkE6IxVCz5fFhKl9uYII57Ir3EjwmqBdF3HRYzk8+rEAG/5EhITclJdrFxVr4YRp yNdJ6l9KsSOF43mAK7rg2wsIxPIkcGfQFCs8gNgxqdoje/r5IKRW/jTiYLJGw+UOcrfeOcUYPWT9X lUvChtDUHEt7pi2wrSz3Ijz1zSraA1vYewvS+J/hrpM4yhSwIIw88stcuRi5lNIjDR+wFNlbGyhEB nB4cwFM1cpJwkfkDS3M7JsZDEzxyynG1ei3E6JhH593l+/3gotWGTz7kksyexkiPl2jGWcpNgnSWx 5ELnr+WDgsQ4vA7dFdSA==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.96 #2 (Red Hat Linux)) id 1qh7CO-00AfUo-22; Fri, 15 Sep 2023 11:41:24 +0000 Received: from m12.mail.163.com ([220.181.12.198]) by bombadil.infradead.org with esmtp (Exim 4.96 #2 (Red Hat Linux)) id 1qh7CL-00AfU6-0p for linux-arm-kernel@lists.infradead.org; Fri, 15 Sep 2023 11:41:22 +0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=163.com; s=s110527; h=From:Subject:Date:Message-Id:MIME-Version; bh=CY24/ IMTGSKHaAaQ0QLN5OMMOE+Jf5xAvkok9QROw60=; b=IZiM7RFLF8MgGALmCSxP2 am2EDpRYwYrln2uVfgW5s4tLhp4AxqhuO3AWPvpDjQ8toRyBJpkR0tLHYv/T0hq2 5jRbWXQwsXh6DFKIJ+Wls1b+IWLRcGqQn9kWyWAPTbz8VrJucTKqhppLiV9E3Em5 oXjy0rEhI71b5jb4U7KiN8= Received: from icess-ProLiant-DL380-Gen10.. (unknown [183.174.60.14]) by zwqz-smtp-mta-g5-4 (Coremail) with SMTP id _____wDnaCG4QgRliT58CA--.42312S4; Fri, 15 Sep 2023 19:40:51 +0800 (CST) From: Ma Ke To: mripard@kernel.org, paul.kocialkowski@bootlin.com, mchehab@kernel.org, gregkh@linuxfoundation.org, wens@csie.org, jernej.skrabec@gmail.com, samuel@sholland.org Cc: linux-media@vger.kernel.org, linux-staging@lists.linux.dev, linux-arm-kernel@lists.infradead.org, linux-sunxi@lists.linux.dev, Ma Ke Subject: [PATCH] media: cedrus: fix use after free bug in cedrus_remove due to race condition Date: Fri, 15 Sep 2023 19:40:38 +0800 Message-Id: <20230915114038.3407953-1-make_ruc2021@163.com> X-Mailer: git-send-email 2.37.2 MIME-Version: 1.0 X-CM-TRANSID: _____wDnaCG4QgRliT58CA--.42312S4 X-Coremail-Antispam: 1Uf129KBjvdXoWrtr1UGry8Gw4kGrW7ZF1DWrg_yoWkKrbEkF yvyw1I9r1UCrykZasrKF45ArWFvr4xZFWkJw4YqFZxAayUAFZ5JrWqyrs3J34ag3yxKF9x ArWvqr45Gw47XjkaLaAFLSUrUUUUUb8apTn2vfkv8UJUUUU8Yxn0WfASr-VFAUDa7-sFnT 9fnUUvcSsGvfC2KfnxnUUI43ZEXa7xRKGQ6JUUUUU== X-Originating-IP: [183.174.60.14] X-CM-SenderInfo: 5pdnvshuxfjiisr6il2tof0z/1tbiyAbrC1p7Lw5+dwAAsn X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20230915_044121_635917_E4CC4959 X-CRM114-Status: GOOD ( 10.35 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org In cedrus_probe, dev->watchdog_work is bound with cedrus_watchdog. Then cedrus_device_run may be called to start the work. If we close the file or remove the module which will call cedrus_release and cedrus_remove to make cleanup, there may be an unfinished work. The possible sequence is as follows, which will cause a typical UAF bug. The same thing will happen in cedrus_release, and use ctx after freeing it. Fix it by canceling the work before cleanup in cedrus_release. Signed-off-by: Ma Ke --- drivers/staging/media/sunxi/cedrus/cedrus.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/staging/media/sunxi/cedrus/cedrus.c b/drivers/staging/media/sunxi/cedrus/cedrus.c index 8e248d4a0aec..0a2cb615d717 100644 --- a/drivers/staging/media/sunxi/cedrus/cedrus.c +++ b/drivers/staging/media/sunxi/cedrus/cedrus.c @@ -404,6 +404,8 @@ static int cedrus_release(struct file *file) struct cedrus_ctx *ctx = container_of(file->private_data, struct cedrus_ctx, fh); + cancel_delayed_work_sync(&ctx->dev->watchdog_work); + mutex_lock(&dev->dev_mutex); v4l2_fh_del(&ctx->fh); -- 2.37.2 _______________________________________________ linux-arm-kernel mailing list linux-arm-kernel@lists.infradead.org http://lists.infradead.org/mailman/listinfo/linux-arm-kernel