Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit f20c3270 authored by Zhipeng Lu's avatar Zhipeng Lu Committed by Sasha Levin
Browse files

media: edia: dvbdev: fix a use-after-free 

[ Upstream commit 8c64f4cdf4e6cc5682c52523713af8c39c94e6d5 ]

In dvb_register_device, *pdvbdev is set equal to dvbdev, which is freed
in several error-handling paths. However, *pdvbdev is not set to NULL
after dvbdev's deallocation, causing use-after-frees in many places,
for example, in the following call chain:

budget_register
  |-> dvb_dmxdev_init
        |-> dvb_register_device
  |-> dvb_dmxdev_release
        |-> dvb_unregister_device
              |-> dvb_remove_device
                    |-> dvb_device_put
                          |-> kref_put

When calling dvb_unregister_device, dmxdev->dvbdev (i.e. *pdvbdev in
dvb_register_device) could point to memory that had been freed in
dvb_register_device. Thereafter, this pointer is transferred to
kref_put and triggering a use-after-free.

Link: https://lore.kernel.org/linux-media/20240203134046.3120099-1-alexious@zju.edu.cn


Fixes: b6190102 ("V4L/DVB (5244): Dvbdev: fix illegal re-usage of fileoperations struct")
Signed-off-by: default avatarZhipeng Lu <alexious@zju.edu.cn>
Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@kernel.org>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
parent 0175f2d3

drivers/media/dvb-core/dvbdev.c

+5 −0
Original line number Diff line number Diff line
@@ -504,6 +504,7 @@ int dvb_register_device(struct dvb_adapter *adap, struct dvb_device **pdvbdev, 
		dvbdevfops = kmemdup(template->fops, sizeof(*dvbdevfops), GFP_KERNEL);

		if (!dvbdevfops) {

			kfree(dvbdev);

			*pdvbdev = NULL;

			mutex_unlock(&dvbdev_register_lock);

			return -ENOMEM;

		}
@@ -512,6 +513,7 @@ int dvb_register_device(struct dvb_adapter *adap, struct dvb_device **pdvbdev, 
		if (!new_node) {

			kfree(dvbdevfops);

			kfree(dvbdev);

			*pdvbdev = NULL;

			mutex_unlock(&dvbdev_register_lock);

			return -ENOMEM;

		}
@@ -545,6 +547,7 @@ int dvb_register_device(struct dvb_adapter *adap, struct dvb_device **pdvbdev, 
		}

		list_del (&dvbdev->list_head);

		kfree(dvbdev);

		*pdvbdev = NULL;

		up_write(&minor_rwsem);

		mutex_unlock(&dvbdev_register_lock);

		return -EINVAL;
@@ -567,6 +570,7 @@ int dvb_register_device(struct dvb_adapter *adap, struct dvb_device **pdvbdev, 
		dvb_media_device_free(dvbdev);

		list_del (&dvbdev->list_head);

		kfree(dvbdev);

		*pdvbdev = NULL;

		mutex_unlock(&dvbdev_register_lock);

		return ret;

	}
@@ -585,6 +589,7 @@ int dvb_register_device(struct dvb_adapter *adap, struct dvb_device **pdvbdev, 
		dvb_media_device_free(dvbdev);

		list_del (&dvbdev->list_head);

		kfree(dvbdev);

		*pdvbdev = NULL;

		mutex_unlock(&dvbdev_register_lock);

		return PTR_ERR(clsdev);

	}