Edward Adam Davis 0a0b79ea55 media: pvrusb2: fix uaf in pvr2_context_set_notify ... [Syzbot reported] BUG: KASAN: slab-use-after-free in pvr2_context_set_notify+0x2c4/0x310 drivers/media/usb/pvrusb2/pvrusb2-context.c:35 Read of size 4 at addr ffff888113aeb0d8 by task kworker/1:1/26 CPU: 1 PID: 26 Comm: kworker/1:1 Not tainted 6.8.0-rc1-syzkaller-00046-gf1a27f081c1f #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/25/2024 Workqueue: usb_hub_wq hub_event Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xd9/0x1b0 lib/dump_stack.c:106 print_address_description mm/kasan/report.c:377 [inline] print_report+0xc4/0x620 mm/kasan/report.c:488 kasan_report+0xda/0x110 mm/kasan/report.c:601 pvr2_context_set_notify+0x2c4/0x310 drivers/media/usb/pvrusb2/pvrusb2-context.c:35 pvr2_context_notify drivers/media/usb/pvrusb2/pvrusb2-context.c:95 [inline] pvr2_context_disconnect+0x94/0xb0 drivers/media/usb/pvrusb2/pvrusb2-context.c:272 Freed by task 906: kasan_save_stack+0x33/0x50 mm/kasan/common.c:47 kasan_save_track+0x14/0x30 mm/kasan/common.c:68 kasan_save_free_info+0x3f/0x60 mm/kasan/generic.c:640 poison_slab_object mm/kasan/common.c:241 [inline] __kasan_slab_free+0x106/0x1b0 mm/kasan/common.c:257 kasan_slab_free include/linux/kasan.h:184 [inline] slab_free_hook mm/slub.c:2121 [inline] slab_free mm/slub.c:4299 [inline] kfree+0x105/0x340 mm/slub.c:4409 pvr2_context_check drivers/media/usb/pvrusb2/pvrusb2-context.c:137 [inline] pvr2_context_thread_func+0x69d/0x960 drivers/media/usb/pvrusb2/pvrusb2-context.c:158 [Analyze] Task A set disconnect_flag = !0, which resulted in Task B's condition being met and releasing mp, leading to this issue. [Fix] Place the disconnect_flag assignment operation after all code in pvr2_context_disconnect() to avoid this issue. Reported-and-tested-by: syzbot+ce750e124675d4599449@syzkaller.appspotmail.com Fixes: e5be15c638 ("V4L/DVB (7711): pvrusb2: Fix race on module unload") Signed-off-by: Edward Adam Davis <eadavis@qq.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>		2024-02-28 16:00:33 +01:00
..
Kconfig	media: pvrusb2: fix DVB_CORE dependency	2023-05-13 08:19:54 +01:00
Makefile
pvrusb2-audio.c
pvrusb2-audio.h
pvrusb2-context.c	media: pvrusb2: fix uaf in pvr2_context_set_notify	2024-02-28 16:00:33 +01:00
pvrusb2-context.h
pvrusb2-cs53l32a.c
pvrusb2-cs53l32a.h
pvrusb2-ctrl.c
pvrusb2-ctrl.h
pvrusb2-cx2584x-v4l.c
pvrusb2-cx2584x-v4l.h
pvrusb2-debug.h
pvrusb2-debugifc.c
pvrusb2-debugifc.h
pvrusb2-devattr.c
pvrusb2-devattr.h
pvrusb2-dvb.c	media: pvrusb2: fix pvr2_stream_callback casts	2024-02-16 11:46:33 +01:00
pvrusb2-dvb.h
pvrusb2-eeprom.c
pvrusb2-eeprom.h
pvrusb2-encoder.c
pvrusb2-encoder.h
pvrusb2-fx2-cmd.h
pvrusb2-hdw-internal.h
pvrusb2-hdw.c	media: usb: pvrusb2: fix inconsistent indenting	2023-08-10 07:58:36 +02:00
pvrusb2-hdw.h
pvrusb2-i2c-core.c
pvrusb2-i2c-core.h
pvrusb2-io.c
pvrusb2-io.h
pvrusb2-ioread.c
pvrusb2-ioread.h
pvrusb2-main.c	media: pvrusb2: clean up unneeded complexity in pvrusb2 class logic	2023-03-31 11:04:10 +02:00
pvrusb2-std.c
pvrusb2-std.h
pvrusb2-sysfs.c	media: pvrusb2: use sysfs_emit() to instead of scnprintf()	2023-07-19 12:57:46 +02:00
pvrusb2-sysfs.h	media: pvrusb2: clean up unneeded complexity in pvrusb2 class logic	2023-03-31 11:04:10 +02:00
pvrusb2-util.h
pvrusb2-v4l2.c	media: pvrusb2: fix pvr2_stream_callback casts	2024-02-16 11:46:33 +01:00
pvrusb2-v4l2.h
pvrusb2-video-v4l.c
pvrusb2-video-v4l.h
pvrusb2-wm8775.c
pvrusb2-wm8775.h
pvrusb2.h