From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp153-162.sina.com.cn (smtp153-162.sina.com.cn [61.135.153.162]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D97CA3DD504 for ; Tue, 19 May 2026 21:16:10 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=61.135.153.162 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779225377; cv=none; b=kDoLGYeEORgFT81paOCfM8iG9boG+sLc61udGtYqvR0xY3BBJXSNC+ehJZhSw90gJmsarI4F2WnjnfDdQZfqjRNdlahXEQBh6lP60ctqr2oTEUCDjeGLHsH7raE2WqP/RZI2tcT/ovWiGU0I6suh5mYcWcwWZVNleTxdQJt032g= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779225377; c=relaxed/simple; bh=BBlEBeqB+PoyoPifviZgwuZ9xbp7WSqkHi2qx8buDnk=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=QG93t26F3Vcl9YRlfOTivK8ItmCm+fj2ezWWJVOnWtXkkUxJUolrA4vrX6V+JsJBCm6WP64IffzHHMSM/Yj2uTgN+S3cX+gKPZj6ogE72aMivVdJf2E4etiG29V+F8ViCCJRUgawx6adAcKFO0av5PafSkh0UILKLoRM5vXPFbY= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=sina.com; spf=pass smtp.mailfrom=sina.com; dkim=pass (1024-bit key) header.d=sina.com header.i=@sina.com header.b=gZDH3YpA; arc=none smtp.client-ip=61.135.153.162 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=sina.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=sina.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=sina.com header.i=@sina.com header.b="gZDH3YpA" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sina.com; s=201208; t=1779225371; bh=hEHty2k4meSkuJyXOr7GpcJH2Igvo8dRaUue15eUypg=; h=From:Subject:Date:Message-ID; b=gZDH3YpAxwKQtX0KS6ku5cFG4KlieOCln06Xl8rJKcK2X7BOxFleS18K/sir4G8hp lXF6375wgp5OYoyk4DJv6gkYbQPS3xpPZsVdpe7IUMr5AfhSf+/q21cpur8KG0pk7r /lTBTlgb9ygL+lE4+022/N1Jlawt4c8xohZRLQVw= X-SMAIL-HELO: localhost.localdomain Received: from unknown (HELO localhost.localdomain)([114.249.62.144]) by sina.com (10.54.253.31) with ESMTP id 6A0CD2F10000253D; Tue, 20 May 2026 05:15:30 +0800 (CST) X-Sender: hdanton@sina.com X-Auth-ID: hdanton@sina.com Authentication-Results: sina.com; spf=none smtp.mailfrom=hdanton@sina.com; dkim=none header.i=none; dmarc=none action=none header.from=hdanton@sina.com X-SMAIL-MID: 7192836816420 X-SMAIL-UIID: F5A0BA850BEE48DDA7824278CA8BECBF-20260520-051530-1 From: Hillf Danton To: Yun Zhou Cc: mchehab@kernel.org, hverkuil+cisco@kernel.org, sakari.ailus@linux.intel.com, linux-media@vger.kernel.org, linux-kernel@vger.kernel.org, stable@vger.kernel.org Subject: Re: [PATCH v2] media: dvb-core: fix use-after-free in dvb_frontend_open() Date: Wed, 20 May 2026 05:15:19 +0800 Message-ID: <20260519211520.829-1-hdanton@sina.com> In-Reply-To: <20260519051020.628298-1-yun.zhou@windriver.com> References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit On Tue, 19 May 2026 13:10:20 +0800 Yun Zhou wrote: > dvb_frontend_open() calls dvb_generic_release() in its error path after > dvb_generic_open() succeeds. dvb_generic_release() drops the device > reference via dvb_device_put(), and then dvb_device_open() drops it again > in its error handling, causing a use-after-free and refcount underflow. > > Fix this by introducing __dvb_generic_release() which only restores the > users/readers/writers counters without dropping the device reference. Use > it in dvb_frontend_open()'s error path so that dvb_device_open() remains > the sole owner of the dvb_device_put() on open failure. > Given the relevant code snippet dvb_device_open() mutex_lock(&dvbdev_mutex); down_read(&minor_rwsem); dvbdev = dvb_minors[minor]; if (dvbdev && dvbdev->fops) { dvb_device_get(dvbdev); err = file->f_op->open(inode, file); up_read(&minor_rwsem); mutex_unlock(&dvbdev_mutex); if (err) dvb_device_put(dvbdev); } a) the frontend open callback is invoked with refcount incremented, so why could a single put in the err path drop refcount to ground? b) worse dvbdev is freed without clearing dvb_minors[minor]. One explanation sounds like dvb_device_open(); // err with refcount dropped but // without clearing dvb_minors[minor] dvb_device_open(); // single put frees dvbdev so a simpler fix looks like incrementing refcount before dvb_generic_release() in the err path. > Reported-by: syzbot+40339ea82afa8184ad5d@syzkaller.appspotmail.com > Closes: https://syzkaller.appspot.com/bug?extid=40339ea82afa8184ad5d > Cc: stable@vger.kernel.org > Fixes: 0fc044b2b5e2 ("media: dvbdev: adopts refcnt to avoid UAF") > Signed-off-by: Yun Zhou > --- > v2: > - Fix Fixes tag commit title > - Add Closes: link after Reported-by > - Cc stable@vger.kernel.org > > drivers/media/dvb-core/dvb_frontend.c | 2 +- > drivers/media/dvb-core/dvbdev.c | 17 ++++++++++++----- > include/media/dvbdev.h | 12 ++++++++++++ > 3 files changed, 25 insertions(+), 6 deletions(-) > > diff --git a/drivers/media/dvb-core/dvb_frontend.c b/drivers/media/dvb-core/dvb_frontend.c > index d082b6c57c76..497f5920b267 100644 > --- a/drivers/media/dvb-core/dvb_frontend.c > +++ b/drivers/media/dvb-core/dvb_frontend.c > @@ -2887,7 +2887,7 @@ static int dvb_frontend_open(struct inode *inode, struct file *file) > mutex_unlock(&fe->dvb->mdev_lock); > err2: > #endif > - dvb_generic_release(inode, file); > + __dvb_generic_release(inode, file); > err1: > if (dvbdev->users == -1 && fe->ops.ts_bus_ctrl) > fe->ops.ts_bus_ctrl(fe, 0); > diff --git a/drivers/media/dvb-core/dvbdev.c b/drivers/media/dvb-core/dvbdev.c > index d753d329502a..3e0ad67b79a3 100644 > --- a/drivers/media/dvb-core/dvbdev.c > +++ b/drivers/media/dvb-core/dvbdev.c > @@ -152,19 +152,26 @@ int dvb_generic_open(struct inode *inode, struct file *file) > } > EXPORT_SYMBOL(dvb_generic_open); > > -int dvb_generic_release(struct inode *inode, struct file *file) > +void __dvb_generic_release(struct inode *inode, struct file *file) > { > struct dvb_device *dvbdev = file->private_data; > > - if (!dvbdev) > - return -ENODEV; > - > if ((file->f_flags & O_ACCMODE) == O_RDONLY) > dvbdev->readers++; > else > dvbdev->writers++; > - > dvbdev->users++; > +} > +EXPORT_SYMBOL(__dvb_generic_release); > + > +int dvb_generic_release(struct inode *inode, struct file *file) > +{ > + struct dvb_device *dvbdev = file->private_data; > + > + if (!dvbdev) > + return -ENODEV; > + > + __dvb_generic_release(inode, file); > > dvb_device_put(dvbdev); > > diff --git a/include/media/dvbdev.h b/include/media/dvbdev.h > index e5a00d126612..9e6e5cb43dcb 100644 > --- a/include/media/dvbdev.h > +++ b/include/media/dvbdev.h > @@ -343,6 +343,18 @@ int dvb_create_media_graph(struct dvb_adapter *adap, > */ > int dvb_generic_open(struct inode *inode, struct file *file); > > +/* > + * __dvb_generic_release - Undo dvb_generic_open() counters WITHOUT > + * dropping the device reference. > + * > + * @inode: pointer to &struct inode. > + * @file: pointer to &struct file. > + * > + * Used in cases where the caller handles dvb_device_put() and ensures > + * that dvbdev is valid. > + */ > +void __dvb_generic_release(struct inode *inode, struct file *file); > + > /** > * dvb_generic_release - Digital TV close function, used by DVB devices > * > -- > 2.43.0