From patchwork Sat Jun 24 14:50:50 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Zheng Wang X-Patchwork-Id: 112470 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a59:994d:0:b0:3d9:f83d:47d9 with SMTP id k13csp6460991vqr; Sat, 24 Jun 2023 08:26:38 -0700 (PDT) X-Google-Smtp-Source: ACHHUZ7nJMRhxwZIZpZESG0jaRqF6s5A7uPS7DmbFozPI6fdQQ6/WlJGgzEyvAFTgQ5orkllokbY X-Received: by 2002:a17:90a:8a87:b0:25e:f6c0:8327 with SMTP id x7-20020a17090a8a8700b0025ef6c08327mr19283373pjn.47.1687620398040; Sat, 24 Jun 2023 08:26:38 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1687620397; cv=none; d=google.com; s=arc-20160816; b=BFlkd6+FI1Ofzn38H0DR/6vko1llo7/UM6Z2LmGYojfr4s5GreYxMIY3nz+Qht8v63 RAVC/7fWaDEz/Az4xoYQEX9EMFq/38o0+86a8y2c1Vk8PiEo4sOK8IhMOwlA/QKBsIZr r3TTL6CEv4KUXJ76W1uQD/mO3umZ22Z91xkIEDg101lMQaNUgDH/nsRfN9ddp1+X+vlJ SL1xlC7qBp/rYT5jEkS72u9+JAoyPibxRvKwUY6ikaXkwAScdSFELbqhMCUnZ0RxAFyq FS+19juP7h96r2vN5n9m1u4WL6aawRj9DKKJ938wE4T06pQj2/Sl017YUshVbaZBi32H 1dmg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :message-id:date:subject:cc:to:from:dkim-signature; bh=1ZSFgIwAdkqH7N1HARcWbHynu04UbnWZF0dHrxv5TFE=; fh=5VNhu3+FmmsFKDPzRn4T7zlVRphQa3+/jo7zA02nAnM=; b=Ksw6/+ht+28EyQdZsE6tlJrzVdQHG+7i9W+Zl8o55oDaFldr0rkA9xbwdhFf31fHIv OyYepYTK9vBavhq15pYOXOyzACw0yxHIyWplXyN+MWvh2ylP4FFFh9CJcX8WTAogR6nZ +dpOXxS8enHNYQbmuKCFu6T4LFpptxXrlUm51MebH09xXqq09SpSDRAebqrKdb0JmlPp o1w2d4vlqUGfJF9KgPka3L2mIih3Kns7d4Yfszxzn/V8DQg6ET8DxEKKfdqjF1JIhmQK SHXwoD4KO+YBV9RiD4vwezwda0WfDrPT1mZeJS8J7wB2JzctOMvsjEPammD7nvOmuwWJ 6NDQ== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@163.com header.s=s110527 header.b=clZDSTXX; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=163.com Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id c5-20020a6566c5000000b005575f8ae186si1667645pgw.821.2023.06.24.08.26.25; Sat, 24 Jun 2023 08:26:37 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@163.com header.s=s110527 header.b=clZDSTXX; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=163.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233125AbjFXOwq (ORCPT + 99 others); Sat, 24 Jun 2023 10:52:46 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:42840 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229445AbjFXOwp (ORCPT ); Sat, 24 Jun 2023 10:52:45 -0400 Received: from m12.mail.163.com (m12.mail.163.com [220.181.12.196]) by lindbergh.monkeyblade.net (Postfix) with ESMTP id AFA47E56; Sat, 24 Jun 2023 07:52:41 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=163.com; s=s110527; h=From:Subject:Date:Message-Id:MIME-Version; bh=1ZSFg IwAdkqH7N1HARcWbHynu04UbnWZF0dHrxv5TFE=; b=clZDSTXXOe1roNMml2F4c 0lkMYMEJANi7FzkxBOjJtyLTExgu4Zo+3xPnFGT+pOjbkTpwS+arNAYvie8AXHJA G3Djnzn2U0G33Pr8Id02IdMsSg+BOT8M6s0HvcOkpcilannIeFetr9y+/7acENZW VH0VHZsVBsEeFeDQ/seBoo= Received: from leanderwang-LC2.localdomain (unknown [111.206.145.21]) by zwqz-smtp-mta-g1-2 (Coremail) with SMTP id _____wBXizjPApdkbk0WAw--.46043S2; Sat, 24 Jun 2023 22:50:55 +0800 (CST) From: Zheng Wang To: Kyrie.Wu@mediatek.com Cc: bin.liu@mediatek.com, mchehab@kernel.org, matthias.bgg@gmail.com, angelogioacchino.delregno@collabora.com, linux-media@vger.kernel.org, linux-kernel@vger.kernel.org, linux-arm-kernel@lists.infradead.org, linux-mediatek@lists.infradead.org, Irui.Wang@mediatek.com, security@kernel.org, hackerzheng666@gmail.com, 1395428693sheep@gmail.com, alex000young@gmail.com, Zheng Wang Subject: [PATCH v2] media: mtk-jpeg: Fix use after free bug due to uncanceled work Date: Sat, 24 Jun 2023 22:50:50 +0800 Message-Id: <20230624145050.2471885-1-zyytlz.wz@163.com> X-Mailer: git-send-email 2.25.1 MIME-Version: 1.0 X-CM-TRANSID: _____wBXizjPApdkbk0WAw--.46043S2 X-Coremail-Antispam: 1Uf129KBjvJXoW7uF17uw15Jr4xtw4xCFy7trb_yoW8Wr43pr W3K3yUCrWUGFs0qr1UJ3W7ZFyrCwnxKa1xWr17uw4Iv393Jrs7JryFya48tFWIyF92kayf Jr18X34xGr4qvFJanT9S1TB71UUUUUUqnTZGkaVYY2UrUUUUjbIjqfuFe4nvWSU5nxnvy2 9KBjDUYxBIdaVFxhVjvjDU0xZFpf9x0ziaZXrUUUUU= X-Originating-IP: [111.206.145.21] X-CM-SenderInfo: h2113zf2oz6qqrwthudrp/1tbiXRKYU1WBqAoK0wAAsr X-Spam-Status: No, score=-2.1 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,FREEMAIL_FROM, RCVD_IN_DNSWL_NONE,RCVD_IN_MSPIKE_BL,RCVD_IN_MSPIKE_L4,SPF_HELO_NONE, SPF_PASS,T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1769598246217122670?= X-GMAIL-MSGID: =?utf-8?q?1769598246217122670?= In mtk_jpeg_probe, &jpeg->job_timeout_work is bound with mtk_jpeg_job_timeout_work. Then mtk_jpeg_dec_device_run and mtk_jpeg_enc_device_run may be called to start the work. If we remove the module which will call mtk_jpeg_remove to make cleanup, there may be a unfinished work. The possible sequence is as follows, which will cause a typical UAF bug. Fix it by canceling the work before cleanup in the mtk_jpeg_remove CPU0 CPU1 |mtk_jpeg_job_timeout_work mtk_jpeg_remove | v4l2_m2m_release | kfree(m2m_dev); | | | v4l2_m2m_get_curr_priv | m2m_dev->curr_ctx //use Fixes: b2f0d2724ba4 ("[media] vcodec: mediatek: Add Mediatek JPEG Decoder Driver") Signed-off-by: Zheng Wang --- - v2: use cancel_delayed_work_sync instead of cancel_delayed_work suggested by Kyrie. --- drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c b/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c index 0051f372a66c..6069ecf420b0 100644 --- a/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c +++ b/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c @@ -1816,6 +1816,7 @@ static void mtk_jpeg_remove(struct platform_device *pdev) { struct mtk_jpeg_dev *jpeg = platform_get_drvdata(pdev); + cancel_delayed_work_sync(&jpeg->job_timeout_work); pm_runtime_disable(&pdev->dev); video_unregister_device(jpeg->vdev); v4l2_m2m_release(jpeg->m2m_dev);