From patchwork Thu Apr 13 03:44:05 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Zheng Wang X-Patchwork-Id: 82753 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a59:b0ea:0:b0:3b6:4342:cba0 with SMTP id b10csp764226vqo; Wed, 12 Apr 2023 20:50:23 -0700 (PDT) X-Google-Smtp-Source: AKy350bCEPitm1+Ocd1RCqwLy4Yenrj1fmNwAbrn5iWVON8JSKu0xhCMkhCdx5lGwU7w6QzzqmVX X-Received: by 2002:a17:906:1f09:b0:94a:32ed:5cb7 with SMTP id w9-20020a1709061f0900b0094a32ed5cb7mr1279883ejj.31.1681357823737; Wed, 12 Apr 2023 20:50:23 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1681357823; cv=none; d=google.com; s=arc-20160816; b=VtGQ6rlDTRUdKFCLvcT1VoO8vkU/T5LzvPQraIuluyy7mCodcN4R7ysiYmYJN+lLKH 4Cvcx/E+LcXYrs1Lf4OOUFuyMisn3jDw9pTbxAdzpQNjYDg6/l50pX1IyLr5CMTNCjWD viVfwLU5N6ddaRQxOFrLATu+GJY74XTyZnf80NF3xvET8oEW2IR8ZsSwNOJboespfnIB kRkFTdnxHx/G2vSaGEXmJxTano8mhfdznF4gbBjX6kd36nN54J6CtBPeMTdR1PePAlee rNhqmcU//jPA3N98cqZPhHvpwe7/np/9X3vigp2nwufO6mR1gMCzhEKb0wP34/+xzyye Jijg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :message-id:date:subject:cc:to:from:dkim-signature; bh=H3yhFAvyem7KDnFlCyJY7TE1lpzbuiAFzAh4R+WP3vc=; b=Kc/XAaK+UuNR/vvgWM85pxbarRMNWXE10MkGa8mx0hoHduDtZ/4u7CNsEbSi7rRXa9 HfNY2Vc6FUvWkc4lwBDqMs0a6GW2IUrGuqLklaJWqIPPaMUo6KD9ZFgJ9OEuB1tXhAOj L1V+/rUyE0tS8ZLv0HRM4ruP4r5TRNdyHlM+95wTT6lSoYQDY8iX9SmIVXfZzAtaMvE9 aiB7xxIYC88JD4Ifiv3QpymHhdHlF9YBwkFgrAPRrkejTi/GaUH2f8Z8/ZNSXI3qp68N Saog6FBjwvn0maRjZhO64mZl2e/2Tnh84+HbLAUUFQkfek4qV1LpXynRA9odyCDwJoEH 4B0w== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@163.com header.s=s110527 header.b=OmXjSMzZ; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=163.com Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id fb18-20020a1709073a1200b009498830ff55si684882ejc.341.2023.04.12.20.50.00; Wed, 12 Apr 2023 20:50:23 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@163.com header.s=s110527 header.b=OmXjSMzZ; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=163.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229791AbjDMDou (ORCPT + 99 others); Wed, 12 Apr 2023 23:44:50 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:54972 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229742AbjDMDoq (ORCPT ); Wed, 12 Apr 2023 23:44:46 -0400 Received: from m12.mail.163.com (m12.mail.163.com [220.181.12.216]) by lindbergh.monkeyblade.net (Postfix) with ESMTP id 73F824EE5; Wed, 12 Apr 2023 20:44:42 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=163.com; s=s110527; h=From:Subject:Date:Message-Id:MIME-Version; bh=H3yhF Avyem7KDnFlCyJY7TE1lpzbuiAFzAh4R+WP3vc=; b=OmXjSMzZAcLSWJjrO0K6n 99GE4FRsIuCiQcmAwg5q0ppzOqfKJaGZ36k8ayMHG6DiAjoHaGQvBw7I6anqHlYw aPAnaz0HLbEgLqekAdBYYHlTkmEtpYP7CZgDEzLmnibMr5b8RU9g5hzJLHEfx65b 560AvmpQXT0927I3B3CPYo= Received: from leanderwang-LC2.localdomain (unknown [111.206.145.21]) by zwqz-smtp-mta-g1-2 (Coremail) with SMTP id _____wCXt2eGejdkzWFfBQ--.36620S2; Thu, 13 Apr 2023 11:44:06 +0800 (CST) From: Zheng Wang To: mchehab@kernel.org Cc: laurent.pinchart@ideasonboard.com, sakari.ailus@linux.intel.com, linux-media@vger.kernel.org, linux-kernel@vger.kernel.org, alex000young@gmail.com, hackerzheng666@gmail.com, security@kernel.org, hdanton@sina.com, Zheng Wang Subject: [RESEND PATCH v2] media: bttv: fix use after free error due to btv->timeout timer Date: Thu, 13 Apr 2023 11:44:05 +0800 Message-Id: <20230413034405.36037-1-zyytlz.wz@163.com> X-Mailer: git-send-email 2.25.1 MIME-Version: 1.0 X-CM-TRANSID: _____wCXt2eGejdkzWFfBQ--.36620S2 X-Coremail-Antispam: 1Uf129KBjvJXoW7ZFy7GF43Zr1xXFykur43Awb_yoW8Jw1kpa ySka43CFy8Xr4UtFyUAF4kZFy3A398XrWFg34xG3ZavF4fZF92vF4jyFWqvF17XF92qrya qa4Fqr13J3WkCFJanT9S1TB71UUUUUUqnTZGkaVYY2UrUUUUjbIjqfuFe4nvWSU5nxnvy2 9KBjDUYxBIdaVFxhVjvjDU0xZFpf9x0zinjjPUUUUU= X-Originating-IP: [111.206.145.21] X-CM-SenderInfo: h2113zf2oz6qqrwthudrp/xtbBzgFQU2I0Yp2FlgABs3 X-Spam-Status: No, score=-2.1 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,FREEMAIL_FROM,RCVD_IN_MSPIKE_H2, SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1763031461299705491?= X-GMAIL-MSGID: =?utf-8?q?1763031461299705491?= There may be some a race condition between timer function bttv_irq_timeout and bttv_remove. The timer is setup in probe and there is no timer_delete operation in remove function. When it hit kfree btv, the function might still be invoked, which will cause use after free bug. This bug is found by static analysis, it may be false positive. Fix it by adding del_timer_sync invoking to the remove function. cpu0 cpu1 bttv_probe ->timer_setup ->bttv_set_dma ->mod_timer; bttv_remove ->kfree(btv); ->bttv_irq_timeout ->USE btv Signed-off-by: Zheng Wang --- v2: - stop replacing del_timer with del_timer_sync suggested by Hillf Danton --- drivers/media/pci/bt8xx/bttv-driver.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/media/pci/bt8xx/bttv-driver.c b/drivers/media/pci/bt8xx/bttv-driver.c index d40b537f4e98..24ba5729969d 100644 --- a/drivers/media/pci/bt8xx/bttv-driver.c +++ b/drivers/media/pci/bt8xx/bttv-driver.c @@ -4248,6 +4248,7 @@ static void bttv_remove(struct pci_dev *pci_dev) /* free resources */ free_irq(btv->c.pci->irq,btv); + del_timer_sync(&btv->timeout); iounmap(btv->bt848_mmio); release_mem_region(pci_resource_start(btv->c.pci,0), pci_resource_len(btv->c.pci,0));