Re: [PATCH v4 11/15] media: rc: Use after free in ir_raw_event_handle()

[Hans Verkuil <hverkuil+cisco@kernel.org>]

On 27/07/2026 15:18, Sean Young wrote:
> If rc_unregister_device() is called while IR is being processed, then
> ir_raw_event_handle() could call wake_up_process(dev->raw->thread)
> after kthread_stop(dev->raw->thread).
> 
> Fixes: dccc0c3ddf8f ("media: rc: fix race between unregister and urb/irq callbacks")
> Signed-off-by: Sean Young <sean@mess.org>
> Cc: stable@vger.kernel.org
> ---
>  drivers/media/rc/rc-ir-raw.c | 10 ++++++++--
>  1 file changed, 8 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/media/rc/rc-ir-raw.c b/drivers/media/rc/rc-ir-raw.c
> index ba24c2f22d39..96849faafde3 100644
> --- a/drivers/media/rc/rc-ir-raw.c
> +++ b/drivers/media/rc/rc-ir-raw.c
> @@ -637,6 +637,7 @@ int ir_raw_event_register(struct rc_dev *dev)
>  	if (IS_ERR(thread))
>  		return PTR_ERR(thread);
>  
> +	get_task_struct(thread);
>  	dev->raw->thread = thread;
>  
>  	mutex_lock(&ir_raw_handler_lock);
> @@ -648,8 +649,13 @@ int ir_raw_event_register(struct rc_dev *dev)
>  
>  void ir_raw_event_free(struct rc_dev *dev)
>  {
> -	kfree(dev->raw);
> -	dev->raw = NULL;
> +	if (dev->raw) {
> +		timer_delete_sync(&dev->raw->edge_handle);
> +		if (dev->raw->thread)
> +			put_task_struct(dev->raw->thread);
> +		kfree(dev->raw);
> +		dev->raw = NULL;
> +	}
>  }
>  
>  void ir_raw_event_unregister(struct rc_dev *dev)

I think this patch could do with some comments in the code explaining why
you need get/put_task_struct.

It's the first time I've seen these functions being used, and I'm not sure
why they solve the issue or whether this is the right approach.

Regards,

	Hans