Re: [RFC PATCH] media: vidtv: fix uaf in vidtv_bridge_on_new_pkts_avail

[Greg KH <gregkh@linuxfoundation.org>]

On Thu, Aug 27, 2026 at 09:56:15AM +0530, Jeffin Philip wrote:
> >Attempting to unbind a dvbdevice that is in the process of feeding
> >data causes a UAF as we free the underlying device without
> >stopping the feed first. Fix this by stopping the stream first using
> >vidtv_stop_streaming(). However, our codepath in the reproducer
> >(mentioned in the below reply) does not decrement our users
> >(dmxdev->dvr_dvbdev->users) to 1 after it has been incremented to 2
> >by our read() in the reproducer, that is only possible on .release.
> >This can cause a task hang as dvb_dmxdev_release() uses wait_event()
> >in the wait_queue unless we use a close(fd)(in the reproducer).
> >Is this a problem? Please advise.
> 
> Reproducer:
> 
> #include <fcntl.h>
> #include <unistd.h>
> #include <pthread.h>
> #include <linux/dvb/dmx.h>
> #include <sys/ioctl.h>
> 
> static void *feed_thread(void *arg)
> {
>     int i = 100;
>     int fd = open("/dev/dvb/adapter0/demux0", O_RDWR | O_NONBLOCK);
>     struct dmx_sct_filter_params params = {
>         .pid = 0,
>         .filter = { .filter = {0}, .mask = {0} },
>         .flags = DMX_IMMEDIATE_START,
>     };
>     ioctl(fd, DMX_SET_FILTER, &params);
>     char buf[188];
>     read(fd, buf, sizeof(buf));
>     //no close(fd) here
>     return NULL;
> }
> 
> int main(void)
> {
>     pthread_t t;
>     pthread_create(&t, NULL, feed_thread, NULL);
>     sleep(1);
>     int fd = open("/sys/bus/platform/drivers/vidtv/unbind", O_WRONLY);

While "fun", this is not a normal path that users ever will hit.  See
this thread where I propose tainting the kernel if you attempt to do
this:
	 https://lore.kernel.org/r/20260826-bind_taint-v1-0-52b05f4a965c@linuxfoundation.org

thanks,

greg k-h