From patchwork Thu Apr 13 03:49:42 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Zheng Wang X-Patchwork-Id: 673056 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3ECD6C77B61 for ; Thu, 13 Apr 2023 03:50:20 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229615AbjDMDuT (ORCPT ); Wed, 12 Apr 2023 23:50:19 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:57228 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229522AbjDMDuR (ORCPT ); Wed, 12 Apr 2023 23:50:17 -0400 Received: from m12.mail.163.com (m12.mail.163.com [220.181.12.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTP id 1737610EB; Wed, 12 Apr 2023 20:50:15 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=163.com; s=s110527; h=From:Subject:Date:Message-Id:MIME-Version; bh=p7a8t xy1BJ4nm/iFKntdPMWHPe8SSuw9rmT+BpB8/qQ=; b=UbKAb1QmIiulzv/HeAq6J wYe1Mzhfh8H5XdMiq7ADF2jGzoy270y/sQKgJUnkf2V9K4j07Q6KNtfQMl6pvhZx GizW0aBqQDwJWID1SJM0Ml0fiRenyr9wzOpZN9frVX5slC+sc7PvdpIMM1gKXKkz pCUMx8XWCHztFlibR9vzZ0= Received: from leanderwang-LC2.localdomain (unknown [111.206.145.21]) by zwqz-smtp-mta-g5-3 (Coremail) with SMTP id _____wDHzRbXezdkJthZBQ--.61026S2; Thu, 13 Apr 2023 11:49:43 +0800 (CST) From: Zheng Wang To: mchehab@kernel.org Cc: laurent.pinchart@ideasonboard.com, sakari.ailus@linux.intel.com, linux-media@vger.kernel.org, linux-kernel@vger.kernel.org, alex000young@gmail.com, hackerzheng666@gmail.com, security@kernel.org, hdanton@sina.com, Zheng Wang Subject: [PATCH v3] media: bttv: fix use after free error due to btv->timeout timer Date: Thu, 13 Apr 2023 11:49:42 +0800 Message-Id: <20230413034942.40831-1-zyytlz.wz@163.com> X-Mailer: git-send-email 2.25.1 MIME-Version: 1.0 X-CM-TRANSID: _____wDHzRbXezdkJthZBQ--.61026S2 X-Coremail-Antispam: 1Uf129KBjvJXoW7ZFy7GF43Zr1xXFykur43Awb_yoW8GFyfpa yIkFy3Cry8Xr4UtryUAF4kWFW3A398XrWUKr97WanavF4fAr92vF4jvFyqyF17JryqqrWa qa4Fqw13Ja4DCFJanT9S1TB71UUUUUUqnTZGkaVYY2UrUUUUjbIjqfuFe4nvWSU5nxnvy2 9KBjDUYxBIdaVFxhVjvjDU0xZFpf9x0zinjjPUUUUU= X-Originating-IP: [111.206.145.21] X-CM-SenderInfo: h2113zf2oz6qqrwthudrp/1tbiXBtQU1Xl6PMRVAAAsq Precedence: bulk List-ID: X-Mailing-List: linux-media@vger.kernel.org There may be some a race condition between timer function bttv_irq_timeout and bttv_remove. The timer is setup in probe and there is no timer_delete operation in remove function. When it hit kfree btv, the function might still be invoked, which will cause use after free bug. This bug is found by static analysis, it may be false positive. Fix it by adding del_timer_sync invoking to the remove function. cpu0 cpu1 bttv_probe ->timer_setup ->bttv_set_dma ->mod_timer; bttv_remove ->kfree(btv); ->bttv_irq_timeout ->USE btv Fixes: 162e6376ac58 ("media: pci: Convert timers to use timer_setup()") Signed-off-by: Zheng Wang --- v3: - Add Fix label v2: - stop replacing del_timer with del_timer_sync suggested by Hillf Danton --- drivers/media/pci/bt8xx/bttv-driver.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/media/pci/bt8xx/bttv-driver.c b/drivers/media/pci/bt8xx/bttv-driver.c index d40b537f4e98..24ba5729969d 100644 --- a/drivers/media/pci/bt8xx/bttv-driver.c +++ b/drivers/media/pci/bt8xx/bttv-driver.c @@ -4248,6 +4248,7 @@ static void bttv_remove(struct pci_dev *pci_dev) /* free resources */ free_irq(btv->c.pci->irq,btv); + del_timer_sync(&btv->timeout); iounmap(btv->bt848_mmio); release_mem_region(pci_resource_start(btv->c.pci,0), pci_resource_len(btv->c.pci,0));