From patchwork Thu Apr 13 03:49:42 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Zheng Wang X-Patchwork-Id: 82754 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a59:b0ea:0:b0:3b6:4342:cba0 with SMTP id b10csp765919vqo; Wed, 12 Apr 2023 20:56:22 -0700 (PDT) X-Google-Smtp-Source: AKy350YMqGnUWQYqlW7lWIjnEtCokUDifLOvSSsreHIRKbWfW9rWhYQyFGJ+s6pwlaWa3H1bQmH0 X-Received: by 2002:a05:6402:3554:b0:506:74f5:876f with SMTP id f20-20020a056402355400b0050674f5876fmr5463edd.6.1681358181917; Wed, 12 Apr 2023 20:56:21 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1681358181; cv=none; d=google.com; s=arc-20160816; b=oPp4vW9aIp6HflpV2OWh1beqtRedYZ7B+NS/7ksGUgqCr87IigyjOIDPZrbLfCUhkS FmJsLXLK72F2DQJtoFqZgUVPtYpOmJNjo9OLuE/+cup7bgQN/MLxe4aodmsfsC6TCugo UwbNMSi98aT+hqqb57CkJ1pK1lziAiPTq3qTpElONnkmaHrSZt5a0UC4+nst2GbFy98U DsMk8+wSu9gKSZmZMwQghEZNudgApapFQmVgucit2FRTgD/AqLavpuS3k7Ro84hnSk5H ZXLzNrbK8PYGy9IXEImABV5oQBcAD2nJuG366TV8C4dsHZxY1+f+dOkVVJH6hgqiJd1e gUHw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :message-id:date:subject:cc:to:from:dkim-signature; bh=p7a8txy1BJ4nm/iFKntdPMWHPe8SSuw9rmT+BpB8/qQ=; b=oS0I0ZoetxCMzOcLIPJQExHI1RaNUHsfEcrpRlPx+7eAxy7r4J3MsGXJ0dTHywgQUY JEZmUOMWu7l9zVv30vNBk7p9dHryuZcZ2s1/i5s74/yf43hO87TrSY1BRBPMRM8ls3KT I023VAnaqvujJhmUefkn7aVtKUvCSHsE68KR/QIHJEd7CIe5WbLzdH00PYdPRIsxVmnx lQLBLZMKI90dua4rHvGxXrRecsh0sUFzZljNBOsBaZrBeKp1WDpNou174UBlU37ShxJD ZABlhlotm5QUhjuaTiJeStBWuTB/E4RNAd4uGxtERdfWvgE8TWpM/jBfTIgE4pQ5ZCvY NASw== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@163.com header.s=s110527 header.b=UbKAb1Qm; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=163.com Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id c23-20020aa7df17000000b004fe9345386esi654928edy.585.2023.04.12.20.55.57; Wed, 12 Apr 2023 20:56:21 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@163.com header.s=s110527 header.b=UbKAb1Qm; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=163.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229626AbjDMDuT (ORCPT + 99 others); Wed, 12 Apr 2023 23:50:19 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:57228 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229522AbjDMDuR (ORCPT ); Wed, 12 Apr 2023 23:50:17 -0400 Received: from m12.mail.163.com (m12.mail.163.com [220.181.12.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTP id 1737610EB; Wed, 12 Apr 2023 20:50:15 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=163.com; s=s110527; h=From:Subject:Date:Message-Id:MIME-Version; bh=p7a8t xy1BJ4nm/iFKntdPMWHPe8SSuw9rmT+BpB8/qQ=; b=UbKAb1QmIiulzv/HeAq6J wYe1Mzhfh8H5XdMiq7ADF2jGzoy270y/sQKgJUnkf2V9K4j07Q6KNtfQMl6pvhZx GizW0aBqQDwJWID1SJM0Ml0fiRenyr9wzOpZN9frVX5slC+sc7PvdpIMM1gKXKkz pCUMx8XWCHztFlibR9vzZ0= Received: from leanderwang-LC2.localdomain (unknown [111.206.145.21]) by zwqz-smtp-mta-g5-3 (Coremail) with SMTP id _____wDHzRbXezdkJthZBQ--.61026S2; Thu, 13 Apr 2023 11:49:43 +0800 (CST) From: Zheng Wang To: mchehab@kernel.org Cc: laurent.pinchart@ideasonboard.com, sakari.ailus@linux.intel.com, linux-media@vger.kernel.org, linux-kernel@vger.kernel.org, alex000young@gmail.com, hackerzheng666@gmail.com, security@kernel.org, hdanton@sina.com, Zheng Wang Subject: [PATCH v3] media: bttv: fix use after free error due to btv->timeout timer Date: Thu, 13 Apr 2023 11:49:42 +0800 Message-Id: <20230413034942.40831-1-zyytlz.wz@163.com> X-Mailer: git-send-email 2.25.1 MIME-Version: 1.0 X-CM-TRANSID: _____wDHzRbXezdkJthZBQ--.61026S2 X-Coremail-Antispam: 1Uf129KBjvJXoW7ZFy7GF43Zr1xXFykur43Awb_yoW8GFyfpa yIkFy3Cry8Xr4UtryUAF4kWFW3A398XrWUKr97WanavF4fAr92vF4jvFyqyF17JryqqrWa qa4Fqw13Ja4DCFJanT9S1TB71UUUUUUqnTZGkaVYY2UrUUUUjbIjqfuFe4nvWSU5nxnvy2 9KBjDUYxBIdaVFxhVjvjDU0xZFpf9x0zinjjPUUUUU= X-Originating-IP: [111.206.145.21] X-CM-SenderInfo: h2113zf2oz6qqrwthudrp/1tbiXBtQU1Xl6PMRVAAAsq X-Spam-Status: No, score=-2.1 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,FREEMAIL_FROM,SPF_HELO_NONE, SPF_PASS autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1763031461299705491?= X-GMAIL-MSGID: =?utf-8?q?1763031837379732529?= There may be some a race condition between timer function bttv_irq_timeout and bttv_remove. The timer is setup in probe and there is no timer_delete operation in remove function. When it hit kfree btv, the function might still be invoked, which will cause use after free bug. This bug is found by static analysis, it may be false positive. Fix it by adding del_timer_sync invoking to the remove function. cpu0 cpu1 bttv_probe ->timer_setup ->bttv_set_dma ->mod_timer; bttv_remove ->kfree(btv); ->bttv_irq_timeout ->USE btv Fixes: 162e6376ac58 ("media: pci: Convert timers to use timer_setup()") Signed-off-by: Zheng Wang --- v3: - Add Fix label v2: - stop replacing del_timer with del_timer_sync suggested by Hillf Danton --- drivers/media/pci/bt8xx/bttv-driver.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/media/pci/bt8xx/bttv-driver.c b/drivers/media/pci/bt8xx/bttv-driver.c index d40b537f4e98..24ba5729969d 100644 --- a/drivers/media/pci/bt8xx/bttv-driver.c +++ b/drivers/media/pci/bt8xx/bttv-driver.c @@ -4248,6 +4248,7 @@ static void bttv_remove(struct pci_dev *pci_dev) /* free resources */ free_irq(btv->c.pci->irq,btv); + del_timer_sync(&btv->timeout); iounmap(btv->bt848_mmio); release_mem_region(pci_resource_start(btv->c.pci,0), pci_resource_len(btv->c.pci,0));