* [RFT] media: dvb_frontend: Fix use-after-free in __dvb_frontend_free
@ 2017-10-24 11:36 Arvind Yadav
2017-10-24 11:42 ` Andrey Konovalov
0 siblings, 1 reply; 2+ messages in thread
From: Arvind Yadav @ 2017-10-24 11:36 UTC (permalink / raw)
To: mchehab, max.kellermann, shuah, yamada.masahiro, sakari.ailus,
colin.king, andreyknvl, dvyukov, kcc
Cc: linux-kernel, linux-media, syzkaller
Here, dvb_free_device will free dvb_device. dvb_frontend_invoke_release
is using dvb_device after free.
Signed-off-by: Arvind Yadav <arvind.yadav.cs@gmail.com>
---
This bug report by Andrey Konovalov (usb/media/dtt200u: use-after-free
in __dvb_frontend_free).
drivers/media/dvb-core/dvb_frontend.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/media/dvb-core/dvb_frontend.c b/drivers/media/dvb-core/dvb_frontend.c
index 2fcba16..7f1ef12 100644
--- a/drivers/media/dvb-core/dvb_frontend.c
+++ b/drivers/media/dvb-core/dvb_frontend.c
@@ -147,10 +147,10 @@ static void dvb_frontend_free(struct kref *ref)
container_of(ref, struct dvb_frontend, refcount);
struct dvb_frontend_private *fepriv = fe->frontend_priv;
- dvb_free_device(fepriv->dvbdev);
-
dvb_frontend_invoke_release(fe, fe->ops.release);
+ dvb_free_device(fepriv->dvbdev);
+
kfree(fepriv);
}
--
1.9.1
^ permalink raw reply [flat|nested] 2+ messages in thread
* Re: [RFT] media: dvb_frontend: Fix use-after-free in __dvb_frontend_free
2017-10-24 11:36 [RFT] media: dvb_frontend: Fix use-after-free in __dvb_frontend_free Arvind Yadav
@ 2017-10-24 11:42 ` Andrey Konovalov
0 siblings, 0 replies; 2+ messages in thread
From: Andrey Konovalov @ 2017-10-24 11:42 UTC (permalink / raw)
To: Arvind Yadav
Cc: Mauro Carvalho Chehab, Max Kellermann, Shuah Khan,
Masahiro Yamada, Sakari Ailus, Colin Ian King, Dmitry Vyukov,
Kostya Serebryany, LKML, linux-media, syzkaller,
Matthias Schwarzott
On Tue, Oct 24, 2017 at 1:36 PM, Arvind Yadav <arvind.yadav.cs@gmail.com> wrote:
> Here, dvb_free_device will free dvb_device. dvb_frontend_invoke_release
> is using dvb_device after free.
Hi Arvind,
Matthias already suggested a fix. Also it looks like your patch is
based on an outdated tree, which doesn't contain the commit that seems
to have caused the bug (ead666000a5fe34bdc82d61838e4df2d416ea15e).
Thanks!
>
> Signed-off-by: Arvind Yadav <arvind.yadav.cs@gmail.com>
> ---
> This bug report by Andrey Konovalov (usb/media/dtt200u: use-after-free
> in __dvb_frontend_free).
>
> drivers/media/dvb-core/dvb_frontend.c | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/media/dvb-core/dvb_frontend.c b/drivers/media/dvb-core/dvb_frontend.c
> index 2fcba16..7f1ef12 100644
> --- a/drivers/media/dvb-core/dvb_frontend.c
> +++ b/drivers/media/dvb-core/dvb_frontend.c
> @@ -147,10 +147,10 @@ static void dvb_frontend_free(struct kref *ref)
> container_of(ref, struct dvb_frontend, refcount);
> struct dvb_frontend_private *fepriv = fe->frontend_priv;
>
> - dvb_free_device(fepriv->dvbdev);
> -
> dvb_frontend_invoke_release(fe, fe->ops.release);
>
> + dvb_free_device(fepriv->dvbdev);
> +
> kfree(fepriv);
> }
>
> --
> 1.9.1
>
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2017-10-24 11:42 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2017-10-24 11:36 [RFT] media: dvb_frontend: Fix use-after-free in __dvb_frontend_free Arvind Yadav
2017-10-24 11:42 ` Andrey Konovalov
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®