From nobody Sat Sep 26 23:52:12 2026 Received: from mail-pg1-f170.google.com (mail-pg1-f170.google.com [209.85.215.170]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D0CBB30FF1D for ; Fri, 28 Aug 2026 05:32:53 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.215.170 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787895175; cv=none; b=lRxkXXIeP10NSumrJy8aPBKSWnJ4CDir1QoQqAPOxbgLG9RU6ovw/0veb2VJQMmVYRr5XO+mmvGs0TEoN/v9AQNUt+49I1t2oalXuDZA7M5Dz6XwyCFVFnVcc+0NOv+4RjeT86knMC32fdYCZNjQBjwv4fxrDpAFcfks7JvYQJ0= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787895175; c=relaxed/simple; bh=/GdYAOcGtW4ZEPQ+TChDIHhN3tLRFCYSsNmY5MWYC6Y=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=PVxbZGoDi2nozU+/6h72XicY8vsX4cqCNRLA9XRtK/G927SB0ZNY42KkW7r36nfxvv1xNF8dlu3jVVXuqcQmjrGnLy6IEidGvgdTNO9GMb8llEURr4/hpuYsDW+c6YNKupjRIYzFOpGc2XbkfH6aNH3XLdpMrJJ9nA7q2tYZEdI= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=TEzUTatD; arc=none smtp.client-ip=209.85.215.170 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="TEzUTatD" Received: by mail-pg1-f170.google.com with SMTP id 41be03b00d2f7-cc1c8d4a959so526004a12.3 for ; Thu, 27 Aug 2026 22:32:53 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1787895173; x=1788499973; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=Bd4HWqdqCRRUfdjHaCwJvNT3mp6cdXyqAafiod8JiSo=; b=TEzUTatDcMqiz0XuCT8jdS0vRPw9jaYD5rCK2u4RKmaFx8M8VgIKdV7ZkXOHGEZe5w pYMHpGaFaJBcGVJH652bOpBmYBHdctoV+OOYmwN6IKzTl1tBXu5OV81UhY7q3hlQRC22 tI2jjh5X69NXlAxDk+NiH/d3t552FxcjUnH3t6y79ZGc/xgxe61uKTA794CyHolSsaz/ MjvXbDfnZh+lG94hkcHzr3ok0UBv8owj14AYI63Vc5RFJFH7MyhIfxQxfCo4vQzCQM/G Ov3I2ly80HrKrEu/riKz+x38Eo7piPFH5nRxUqaZrZEP1POcQfkjy1mV5U3FT+JmJQwj k5OQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1787895173; x=1788499973; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=Bd4HWqdqCRRUfdjHaCwJvNT3mp6cdXyqAafiod8JiSo=; b=Saf4TUMaSjyZjhwqTlIKXFdbjzwJg2YW91NAE/W58sThMxk4ll4o6LyKvyGKiSNYpo XnX+W5BdRW7Cq/8NSr9RVKcgl67j3mgh0IQSk0yjuuok3PjaLr/F4QpiUZxvPSUXLz1c VBc8YgvNjA+YLCJsZR6JxUCQsBDPt9lZudcCmXSuK1jsP3w/s+nZDKeF8jARZExqv1jR sTr1TfWHm9iLUDLPBkVLwi12smNNW7fBq3pS0z18yDQE/XL4KwVZ5+Uh0Q30xrsY0CSb k4rQR8u32XXmKDhRpFIsusltjSYEaic9S34z9y2MkWI+7Xt/N4zcKYBr1D2ZIkrefefy FQTA== X-Forwarded-Encrypted: i=1; AHgh+RpbmzZOdgEyBKk/Xl3ou6mdgmQLRxlQmCrdPWdn6UQVJewJcTP8zPCAEQq9YEeHtWSx+UZNNsaT5QAzOkU=@vger.kernel.org X-Gm-Message-State: AFuF++nPs/7lMZ4aqbziVlELWuvKyDTnUwQCeDULHFcDw0XnNgLUl8hN XCfWq8/HiZhtAko+wiIX/9XgZfgpB1HDF6anRrswE6YJVsIlCGYBHZiG X-Gm-Gg: AR+sD12lklh3z36iIpy3GMrwQLgrBMjbWyw09duUlAwIWx+uicSMGpeCih4OB6fJ0J9 eRb+5+W7I5ox+3Uy0nbxLXkA8FZssrZ3o3NFAJN+hboyGHD8JTG69IOP5ZhlKfOTEpWlaCRITF3 es9zf1UTmRL7W544Fwh2KguA6z9+5jNf5xQVEnhOrReZBOHjB4uhHtgTZNYoSYWGb3HY69sUDbz 8EraUkNH4KbhDsoBSXAT7/fWWSGJeGjbhW1GYgZcbbj9/s3+nQX6SEKsom580NT/vPPkE6OdySo qWZnXAo682IvUzFZGGy1D2gLbZndkRIx+K0va6AimBHcfj9/bEQ2snzJns6kilN4pwcbaJ8osuz Qc7Sr2YWjhyiyOOdCok7QZ3dBJPnIfAmtjJ51SLkVSV1cs+7p5CdiWj81zd5eGVaT8pyEBrzP44 nLHKJNGkpmyQTe6vBXoHEDIJYQ0sh4shzrMDOX2wBJoenyRCzOM1xvGq68Y6Z3CyiFBb8LxUcQw 16cIouzF2dWUqMhJ5uRjWTSxkVFrYWW9XADDIn6L/c= X-Received: by 2002:a17:90b:3e43:b0:37f:fd1f:d30f with SMTP id 98e67ed59e1d1-396d0f67646mr9008068a91.12.1787895172935; Thu, 27 Aug 2026 22:32:52 -0700 (PDT) Received: from hnkz-ubuntu-vm1.mshome.net (flh4-125-195-69-140.tky.mesh.ad.jp. [125.195.69.140]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-396ddc07cbbsm1003093a91.10.2026.08.27.22.32.51 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 27 Aug 2026 22:32:52 -0700 (PDT) From: Kazuki Hanai To: Mauro Carvalho Chehab Cc: linux-media@vger.kernel.org, linux-kernel@vger.kernel.org, Kazuki Hanai , stable@vger.kernel.org Subject: [PATCH v2] media: dvb-core: synchronize section timer on feed stop Date: Fri, 28 Aug 2026 14:32:44 +0900 Message-ID: <20260828053244.2010009-1-hnkz.64@gmail.com> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260828052852.1975097-1-hnkz.64@gmail.com> References: <20260828052852.1975097-1-hnkz.64@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" The section filter timeout callback dereferences its dmxdev_filter and parent dmxdev. dvb_dmxdev_feed_stop() currently uses timer_delete(), which can return while the callback is already running. The close path can then release filter-owned resources and allow device teardown to vfree the filter array while the callback is still executing, resulting in a use-after-free. Use timer_delete_sync() at the common section-feed stop boundary. This waits for an active callback before teardown continues while preserving timer reuse across DMX_STOP and later filter restarts. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable@vger.kernel.org Signed-off-by: Kazuki Hanai --- drivers/media/dvb-core/dmxdev.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) Changes in v2: - Add Fixes and stable Cc tags. - Document the pre-rename timer API equivalent for stable backports. For stable trees predating the timer API rename, the equivalent change is del_timer_sync(). diff --git a/drivers/media/dvb-core/dmxdev.c b/drivers/media/dvb-core/dmxde= v.c index 6a825d9bae43..0f5a35bf062d 100644 --- a/drivers/media/dvb-core/dmxdev.c +++ b/drivers/media/dvb-core/dmxdev.c @@ -486,7 +486,7 @@ static int dvb_dmxdev_feed_stop(struct dmxdev_filter *d= mxdevfilter) =20 switch (dmxdevfilter->type) { case DMXDEV_TYPE_SEC: - timer_delete(&dmxdevfilter->timer); + timer_delete_sync(&dmxdevfilter->timer); dmxdevfilter->feed.sec->stop_filtering(dmxdevfilter->feed.sec); break; case DMXDEV_TYPE_PES: --=20 2.53.0