NothingOSS/android_kernel_msm-6.1_nothing_sm7635
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
android_kernel_msm-6.1_noth.../drivers/media
History
Duoming Zhou 07821524f6 media: netup_unidvb: fix use-after-free at del_timer() 
[ Upstream commit 0f5bb36bf9b39a2a96e730bf4455095b50713f63 ]

When Universal DVB card is detaching, netup_unidvb_dma_fini()
uses del_timer() to stop dma->timeout timer. But when timer
handler netup_unidvb_dma_timeout() is running, del_timer()
could not stop it. As a result, the use-after-free bug could
happen. The process is shown below:

    (cleanup routine)          |        (timer routine)
                               | mod_timer(&dev->tx_sim_timer, ..)
netup_unidvb_finidev()         | (wait a time)
  netup_unidvb_dma_fini()      | netup_unidvb_dma_timeout()
    del_timer(&dma->timeout);  |
                               |   ndev->pci_dev->dev //USE

Fix by changing del_timer() to del_timer_sync().

Link: https://lore.kernel.org/linux-media/20230308125514.4208-1-duoming@zju.edu.cn
Fixes: 52b1eaf4c5 ("[media] netup_unidvb: NetUP Universal DVB-S/S2/T/T2/C PCI-E card driver")
Signed-off-by: Duoming Zhou <duoming@zju.edu.cn>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-05-24 17:32:45 +01:00
..
cec media fixes for v6.1-rc2 2022-10-22 15:30:15 -07:00
common media: videobuf2-core: take mmap_lock in vb2_get_unmapped_area() 2022-12-07 11:25:40 -08:00
dvb-core media: dvb-core: Fix UAF due to refcount races at releasing 2023-01-07 11:11:49 +01:00
dvb-frontends media: stv0288: use explicitly signed char 2023-01-07 11:11:36 +01:00
firewire
i2c media: hi846: Fix memleak in hi846_init_controls() 2023-05-11 23:03:15 +09:00
mc media: mc: Get media_device directly from pad 2023-03-10 09:33:42 +01:00
mmc
pci media: netup_unidvb: fix use-after-free at del_timer() 2023-05-24 17:32:45 +01:00
platform media: mediatek: vcodec: Fix potential array out-of-bounds in decoder queue_setup 2023-05-24 17:32:36 +01:00
radio media: si470x: Fix use-after-free in si470x_int_in_callback() 2022-12-31 13:33:04 +01:00
rc media: rc: gpio-ir-recv: Fix support for wake-up 2023-05-11 23:03:15 +09:00
spi
test-drivers media: vimc: Fix wrong function called when vimc_init() fails 2022-12-31 13:32:16 +01:00
tuners media fixes for v6.1-rc2 2022-10-22 15:30:15 -07:00
usb media: Prefer designated initializers over memset for subdev pad ops 2023-05-24 17:32:36 +01:00
v4l2-core media: v4l: async: Return async sub-devices to subnotifier list 2023-05-11 23:03:15 +09:00
Kconfig media: remove reference to CONFIG_EMBEDDED in MEDIA_SUPPORT_FILTER 2022-09-08 18:19:29 +02:00
Makefile