| Message ID | 20230308032333.1893394-1-zyytlz.wz@163.com |
|---|---|
| State | Accepted |
| Commit | 50d0a7aea4809cef87979d4669911276aa23b71f |
| Headers | show |
| Series | media: cedrus: fix use after free bug in cedrus_remove due to race condition | expand |
diff --git a/drivers/staging/media/sunxi/cedrus/cedrus.c b/drivers/staging/media/sunxi/cedrus/cedrus.c index a43d5ff66716..c95d011c0817 100644 --- a/drivers/staging/media/sunxi/cedrus/cedrus.c +++ b/drivers/staging/media/sunxi/cedrus/cedrus.c @@ -546,7 +546,7 @@ static int cedrus_probe(struct platform_device *pdev) static int cedrus_remove(struct platform_device *pdev) { struct cedrus_dev *dev = platform_get_drvdata(pdev); - + cancel_delayed_work(&dev->watchdog_work); if (media_devnode_is_registered(dev->mdev.devnode)) { media_device_unregister(&dev->mdev); v4l2_m2m_unregister_media_controller(dev->m2m_dev);
In cedrus_probe, dev->watchdog_work is bound with cedrus_watchdog function. In cedrus_device_run, it will started by schedule_delayed_work. If there is unfinished work in cedrus_remove, there may be a race condition and trigger UAF bug. CPU0 CPU1 |cedrus_watchdog cedrus_remove | v4l2_m2m_release | kfree(m2m_dev) | | | v4l2_m2m_get_curr_priv | m2m_dev //use Fix it by canceling the worker in cedrus_remove. Signed-off-by: Zheng Wang <zyytlz.wz@163.com> --- drivers/staging/media/sunxi/cedrus/cedrus.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)