From patchwork Sat Apr 15 08:05:48 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Duoming Zhou X-Patchwork-Id: 83645 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a59:b0ea:0:b0:3b6:4342:cba0 with SMTP id b10csp901507vqo; Sat, 15 Apr 2023 01:21:08 -0700 (PDT) X-Google-Smtp-Source: AKy350ao5auCMeB2BqFO5U0y1BLO/Ovq8glK/gcollKGO5ARE2etndKXJ6k1B7j7svOOO41cP+fr X-Received: by 2002:a05:6a21:78a5:b0:ee:58da:4e4c with SMTP id bf37-20020a056a2178a500b000ee58da4e4cmr5251576pzc.1.1681546867726; Sat, 15 Apr 2023 01:21:07 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1681546867; cv=none; d=google.com; s=arc-20160816; b=k6SbFM9CyQ5Nj1iYTYJffewTvENqfZ36K0NTf6+/nPfaorFrEITz0ULwTJ2dzo6QA5 pdr3GPrqI5X4zOf0DDAbwnlDNWBs5ai0oD7Tjzjbh7jbpe929jxOsWlgqh0npBybzxp7 uyToIApP5UoDSAJlguUYsMTLuYv/3521gAMJpdYWJboXDlqW3mRSOISSBirGCsUV0JMP ByHEbU/7T79FfLRvO/OE30HKwwblSEQQWfHcF07K1vHakeWhtmwSv4xBSmGk6A8nmo+U vi9wI/KNtKZFrSUq8YLLrwTrFYih39k4MILOXJ8xrJd6lUmq6P6enE/hbWlmoimyndZf aiFA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:message-id:date:subject:cc:to:from; bh=2oVB/PDaEsh6Q+QadWc0WrNYoIwegU0vvTaClx87M+0=; b=Z9e3CNtUTNL0emzB2Iff7oygNVHSVgaLCGColXYgMEdOzn8bDSuquHxkloeRvVBdJO HoG9HiR/c2lhOvlvuLQpYRMnKb497FLVfMpZVQsJd8gKIn+A4r03XS5+MjtYxvqOPTww Fydd5k0e6SIMutLaS4WSOBn/2XLW/7JHyRTEOG3Pd60byfhiLGrjT+eT0+rb+EZmFNvN 9g1QJKKDAbKc5XjGYkQgK3GGBoxKHdOJJzJidJf4Wt0SFH3eSTez65OMnrLHN+4ZfaV8 5fivO2LTGI9WQ3PzQGXB/Ex2TKjo74q/PkESROpVtLbDbbd6pV7RGs6wLzAGbo0t3Gxn 5L7g== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id m23-20020a6562d7000000b0051344dd6049si6517997pgv.27.2023.04.15.01.20.54; Sat, 15 Apr 2023 01:21:07 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229623AbjDOIGH (ORCPT + 99 others); Sat, 15 Apr 2023 04:06:07 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:48860 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229468AbjDOIGG (ORCPT ); Sat, 15 Apr 2023 04:06:06 -0400 X-Greylist: delayed 342 seconds by postgrey-1.37 at lindbergh.monkeyblade.net; Sat, 15 Apr 2023 01:06:02 PDT Received: from zg8tmja2lje4os4yms4ymjma.icoremail.net (zg8tmja2lje4os4yms4ymjma.icoremail.net [206.189.21.223]) by lindbergh.monkeyblade.net (Postfix) with ESMTP id B533F5FE1; Sat, 15 Apr 2023 01:06:02 -0700 (PDT) Received: from ubuntu.localdomain (unknown [106.117.97.24]) by mail-app4 (Coremail) with SMTP id cS_KCgCHHQveWjpkz2cQAA--.9344S2; Sat, 15 Apr 2023 16:05:57 +0800 (CST) From: Duoming Zhou To: linux-kernel@vger.kernel.org Cc: linux-media@vger.kernel.org, mchehab@kernel.org, aospan@netup.ru, serjk@netup.ru, Duoming Zhou Subject: [PATCH RESEND] media: netup_unidvb: fix use-after-free bug caused by del_timer() Date: Sat, 15 Apr 2023 16:05:48 +0800 Message-Id: <20230415080548.6230-1-duoming@zju.edu.cn> X-Mailer: git-send-email 2.17.1 X-CM-TRANSID: cS_KCgCHHQveWjpkz2cQAA--.9344S2 X-Coremail-Antispam: 1UD129KBjvJXoW7CF4kAF45Cw13CF47Gw48WFg_yoW8XFyxpr WkuF1qyFykJ3y2yw10kw1DWr95X34fJry8Ga48Ca93Ars3Wr18Gw4jk347ZFs7C3WDAFs3 Gr1rXFy3JF17GrDanT9S1TB71UUUUUUqnTZGkaVYY2UrUUUUjbIjqfuFe4nvWSU5nxnvy2 9KBjDU0xBIdaVrnRJUUUkq14x267AKxVWUJVW8JwAFc2x0x2IEx4CE42xK8VAvwI8IcIk0 rVWrJVCq3wAFIxvE14AKwVWUJVWUGwA2ocxC64kIII0Yj41l84x0c7CEw4AK67xGY2AK02 1l84ACjcxK6xIIjxv20xvE14v26w1j6s0DM28EF7xvwVC0I7IYx2IY6xkF7I0E14v26r4U JVWxJr1l84ACjcxK6I8E87Iv67AKxVW0oVCq3wA2z4x0Y4vEx4A2jsIEc7CjxVAFwI0_Gc CE3s1le2I262IYc4CY6c8Ij28IcVAaY2xG8wAqx4xG64xvF2IEw4CE5I8CrVC2j2WlYx0E 2Ix0cI8IcVAFwI0_JrI_JrylYx0Ex4A2jsIE14v26r1j6r4UMcvjeVCFs4IE7xkEbVWUJV W8JwACjcxG0xvY0x0EwIxGrwACjI8F5VA0II8E6IAqYI8I648v4I1lc2xSY4AK67AK6r43 MxAIw28IcxkI7VAKI48JMxC20s026xCaFVCjc4AY6r1j6r4UMI8I3I0E5I8CrVAFwI0_Jr 0_Jr4lx2IqxVCjr7xvwVAFwI0_JrI_JrWlx4CE17CEb7AF67AKxVWUAVWUtwCIc40Y0x0E wIxGrwCI42IY6xIIjxv20xvE14v26r1j6r1xMIIF0xvE2Ix0cI8IcVCY1x0267AKxVW8JV WxJwCI42IY6xAIw20EY4v20xvaj40_Jr0_JF4lIxAIcVC2z280aVAFwI0_Jr0_Gr1lIxAI cVC2z280aVCY1x0267AKxVW8JVW8JrUvcSsGvfC2KfnxnUUI43ZEXa7VUjMKZJUUUUU== X-CM-SenderInfo: qssqjiasttq6lmxovvfxof0/1tbiAwIGAWQ5a9oSIAAss0 X-Spam-Status: No, score=-1.9 required=5.0 tests=BAYES_00,RCVD_IN_MSPIKE_H2, SPF_HELO_NONE,SPF_PASS,T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1763229688182572312?= X-GMAIL-MSGID: =?utf-8?q?1763229688182572312?= When Universal DVB card is detaching, netup_unidvb_dma_fini() uses del_timer() to stop dma->timeout timer. But when timer handler netup_unidvb_dma_timeout() is running, del_timer() could not stop it. As a result, the use-after-free bug could happen. The process is shown below: (cleanup routine) | (timer routine) | mod_timer(&dev->tx_sim_timer, ..) netup_unidvb_finidev() | (wait a time) netup_unidvb_dma_fini() | netup_unidvb_dma_timeout() del_timer(&dma->timeout); | kfree(ndev); //FREE | | ndev->pci_dev->dev //USE Fix by changing del_timer() to del_timer_sync(). Fixes: 52b1eaf4c59a ("[media] netup_unidvb: NetUP Universal DVB-S/S2/T/T2/C PCI-E card driver") Signed-off-by: Duoming Zhou --- drivers/media/pci/netup_unidvb/netup_unidvb_core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/media/pci/netup_unidvb/netup_unidvb_core.c b/drivers/media/pci/netup_unidvb/netup_unidvb_core.c index 8287851b5ff..aaa1d2dedeb 100644 --- a/drivers/media/pci/netup_unidvb/netup_unidvb_core.c +++ b/drivers/media/pci/netup_unidvb/netup_unidvb_core.c @@ -697,7 +697,7 @@ static void netup_unidvb_dma_fini(struct netup_unidvb_dev *ndev, int num) netup_unidvb_dma_enable(dma, 0); msleep(50); cancel_work_sync(&dma->work); - del_timer(&dma->timeout); + del_timer_sync(&dma->timeout); } static int netup_unidvb_dma_setup(struct netup_unidvb_dev *ndev)