From nobody Fri Dec 19 19:15:31 2025 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 1000A284554; Sun, 24 Mar 2024 23:43:15 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1711323795; cv=none; b=olEyakix9BRGriVinvTTCyMN0Y1aSOjFqG1PNDiaWCJUL3Ph35ATNQwcaXzgion/QCiQajKpchQJNrMjcfyPr6Rx035iz6HtBQ/GrPXppx5YrET/X/KPhOUaIPIEg4v3Nhx0xv2trK6CMd4vOPaG7NGGbAHGaaHYFGIHICE/bjM= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1711323795; c=relaxed/simple; bh=zIzrS9FnuADVM5W+mS2X8Ece0Bn7nG81SCezXMUw+EM=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=PDXZpmnt3Deldw4ZsqQgM66rZRCJwsxxksBydFC19SIEk4F+XerBZDzK/c3zmSQ5p0XnBRGUDiqtX9VaqJRveiByWPkcAf4gNo2hm++J/rAEY+N3g41t6hbTTiaL2SsKVvXp/pNexZ6HynaCERIbUH3hlNBKHlTXJuSVhkl0KM0= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=crriO9WD; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="crriO9WD" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 3A36EC43390; Sun, 24 Mar 2024 23:43:14 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1711323794; bh=zIzrS9FnuADVM5W+mS2X8Ece0Bn7nG81SCezXMUw+EM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=crriO9WDUiyYIpP/wGhgS3jj442814iw/PR/loPMdZlnXIG/AoGJf2r2L/kcw83Pt Fi0caMANeSsWtWIEGBXqUHfEn5rDTYlHUumrjRUgkqIcp5ER4v8quOUzOr1AsI/ANP d+dhDJaGF0G41kT+RkZBfHd1sGfq6E4fo4JioHa529cNiBr86IMerVOjeieBw6IdZn 7EGsE6ARG3uNpNUcYQDB5prZl9h2gIoG7Uwl89WO5ElpwKtZyOlYQ6R5bkGsJ/T5Cc LBwdAB0Bru4ZlrmDlJUFcsH444BZGQojKpkn7jHLQJW9+KNrFXfzT54ENOPfnW7Y1J 9iAKs4SyawciA== From: Sasha Levin To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Edward Adam Davis , syzbot+ce750e124675d4599449@syzkaller.appspotmail.com, Hans Verkuil , Sasha Levin Subject: [PATCH 5.10 172/238] media: pvrusb2: fix uaf in pvr2_context_set_notify Date: Sun, 24 Mar 2024 19:39:20 -0400 Message-ID: <20240324234027.1354210-173-sashal@kernel.org> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20240324234027.1354210-1-sashal@kernel.org> References: <20240324234027.1354210-1-sashal@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-stable: review X-Patchwork-Hint: Ignore Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Edward Adam Davis [ Upstream commit 0a0b79ea55de8514e1750884e5fec77f9fdd01ee ] [Syzbot reported] BUG: KASAN: slab-use-after-free in pvr2_context_set_notify+0x2c4/0x310 driv= ers/media/usb/pvrusb2/pvrusb2-context.c:35 Read of size 4 at addr ffff888113aeb0d8 by task kworker/1:1/26 CPU: 1 PID: 26 Comm: kworker/1:1 Not tainted 6.8.0-rc1-syzkaller-00046-gf1a= 27f081c1f #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Goo= gle 01/25/2024 Workqueue: usb_hub_wq hub_event Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xd9/0x1b0 lib/dump_stack.c:106 print_address_description mm/kasan/report.c:377 [inline] print_report+0xc4/0x620 mm/kasan/report.c:488 kasan_report+0xda/0x110 mm/kasan/report.c:601 pvr2_context_set_notify+0x2c4/0x310 drivers/media/usb/pvrusb2/pvrusb2-cont= ext.c:35 pvr2_context_notify drivers/media/usb/pvrusb2/pvrusb2-context.c:95 [inline] pvr2_context_disconnect+0x94/0xb0 drivers/media/usb/pvrusb2/pvrusb2-contex= t.c:272 Freed by task 906: kasan_save_stack+0x33/0x50 mm/kasan/common.c:47 kasan_save_track+0x14/0x30 mm/kasan/common.c:68 kasan_save_free_info+0x3f/0x60 mm/kasan/generic.c:640 poison_slab_object mm/kasan/common.c:241 [inline] __kasan_slab_free+0x106/0x1b0 mm/kasan/common.c:257 kasan_slab_free include/linux/kasan.h:184 [inline] slab_free_hook mm/slub.c:2121 [inline] slab_free mm/slub.c:4299 [inline] kfree+0x105/0x340 mm/slub.c:4409 pvr2_context_check drivers/media/usb/pvrusb2/pvrusb2-context.c:137 [inline] pvr2_context_thread_func+0x69d/0x960 drivers/media/usb/pvrusb2/pvrusb2-cont= ext.c:158 [Analyze] Task A set disconnect_flag =3D !0, which resulted in Task B's condition bei= ng met and releasing mp, leading to this issue. [Fix] Place the disconnect_flag assignment operation after all code in pvr2_conte= xt_disconnect() to avoid this issue. Reported-and-tested-by: syzbot+ce750e124675d4599449@syzkaller.appspotmail.c= om Fixes: e5be15c63804 ("V4L/DVB (7711): pvrusb2: Fix race on module unload") Signed-off-by: Edward Adam Davis Signed-off-by: Hans Verkuil Signed-off-by: Sasha Levin --- drivers/media/usb/pvrusb2/pvrusb2-context.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/media/usb/pvrusb2/pvrusb2-context.c b/drivers/media/us= b/pvrusb2/pvrusb2-context.c index 58f2f3ff10ee2..73c95ba2328a4 100644 --- a/drivers/media/usb/pvrusb2/pvrusb2-context.c +++ b/drivers/media/usb/pvrusb2/pvrusb2-context.c @@ -267,9 +267,9 @@ static void pvr2_context_exit(struct pvr2_context *mp) void pvr2_context_disconnect(struct pvr2_context *mp) { pvr2_hdw_disconnect(mp->hdw); - mp->disconnect_flag =3D !0; if (!pvr2_context_shutok()) pvr2_context_notify(mp); + mp->disconnect_flag =3D !0; } =20 =20 --=20 2.43.0