From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pj1-f44.google.com (mail-pj1-f44.google.com [209.85.216.44]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 1B35333A9D6 for ; Sat, 22 Aug 2026 11:23:16 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.44 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787397798; cv=none; b=WR9+Q2nGDn5nihc9NOIK2Tj1syfq5qP5O0h1dGDi1btyPB5g3KhJ3GoQw0wtBTSgc4iykGF7tsI1BcPJ2rKo6LcQxlYWSZN0h6USALstr7+TsrM1KIK4lWRm379SzGGIbcIjft81uHS5G9qV6PjVSY4tcEDXCKpn/gsyQU+flzg= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787397798; c=relaxed/simple; bh=uJc74lO7WjucvgdI8DkhmeL+OgjdvyWd31lZCUuWJs0=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=Vf9h+3OQ12+jhgUR8qMecNNfpBhxcX1Lx8Wb+o79+BQ8lE4egxorJTQIHor7fcz0jGhVSnVcoBvboRznr2wYWh1hO7AVNYFN70OhqIIlJ2omZEG21RIEkQqBZjMNStAEGcducRucIff2XwKzie2YPHUJnJDuf7iWX1i1spTmebA= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=HSiDAYUF; arc=none smtp.client-ip=209.85.216.44 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="HSiDAYUF" Received: by mail-pj1-f44.google.com with SMTP id 98e67ed59e1d1-38511175ad3so1691492a91.2 for ; Sat, 22 Aug 2026 04:23:16 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1787397795; x=1788002595; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=jkT+mJiPYkVs3Ps4IpYVCOf6FJxHOGfqjEwyUrIBblc=; b=HSiDAYUFTgQK8I0Psv0bxIpdZWOzFdy6f+8CYtGJkGjtcSs9cP5ImAajEEYj3HUTgH oNwF9l5tSBTqF8G8tchvUh0UHh81b6hCLtRF1KNkLVCF/hQqRI/UCIza/twIfizdNzzo VJ5D/gEzjXKBW3XIGFIzYua8Ftsq7oGUezGZmFVPEgy503hLgHDO3ciBJgM8aVa5JzY2 YG9JCdnpTbQkxUVZ6ySXCj3xCCUod1ax+s65wVHj4Fqm4ax05UNXeIjvhy0N5yBnKS6D 7nUxmdoQJ6yCI9t8e1xljoO18+lqkoEEI5MqMch6KsLRSIg6QAPmyRbOqj/T9h93we/O zfyw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1787397795; x=1788002595; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=jkT+mJiPYkVs3Ps4IpYVCOf6FJxHOGfqjEwyUrIBblc=; b=Fy+M306jg/SlkoDnyTyJxvdaD9BmEknDqX2+8hednytX2oPYAJAUpCNlpKSY9vfMgO 6399BMdDYMrBZ4xOqsxxjpYTE78ATy9OTwK+4onVI0Lc88F0f5MglGs6u7lZw/EfjG+6 AkSCk0n5Ib1+zW9Puk8Z7skWvW2bKV05lEgi3UerBvVbLOn9DnAxu58+iQRcVDRgicx9 YqkHn8x9ecpPz05EHC1BlxX7AtzXwQ4zAQau68BYiSnfryJfz5NXg8NbfV/iNTCY/CJc CMYpe2sc95N7EHD5+gfj1jivKiDxfo8VN2fk+2FcQmn4tkkIsBoF7W/PQh6NbunpkL2y 68+w== X-Forwarded-Encrypted: i=1; AHgh+RpL7kL08A6jyLLS5S8Geo69QrLqiNmLp3R0PxQsv+/eFJDVVsLlvuavxCZ3YNWm0N3E3Ad2kN0DRfaklHA=@vger.kernel.org X-Gm-Message-State: AFuF++lXAO1HFh9C1/d2oDzPrIgJ+ExiOUW1be0+BiGnwXtsK8wSbNsT 7dtkZlzNlQvJHpdbGj2syn5ff7XQPvkllQvxHqpxLZQBJCCqpSmbqcnP X-Gm-Gg: AR+sD12kbaaUE+nWDWStCJ/9mVAV1gmsQGkRAb50/9QKeLYhbT/b0dq0yqOs4r0pTUf 0sAHzE5Jgz64840u5A0T0wmbCq0CFEVm4KZRRdKahZj0PptTEkL2Nzl+M7FWVeUqHfsOUH4LjQF hoxEDKDjP9673XRtAcf9vOfsaA21PXdekOyjEqJ17BASSY5hHLhRfU10Bl8wHAhciw9ppW+yUgm BDXWodHSH6WZvX+L7DCtqeFbai4909B3v40jyhJvtWgqLxzcMQD6dk8gKxOd74D5AWF85XRyTWH 6yGH5CSGvFDKN6J5UK6Tb+AfD7ZL/eeeUlY99s/vD+q3K/BEpclXogtO5o2Bgxt/knFjL94mF/M Qgx1CZVQ1f8ySn+uO4Tf/SyldoaM98jM1FR4zxI7ugsW2/cKVgIO+Ul9/8s2uL1GfkoHGq8DRHu BfPZSzoPqnNiHRYZj5/H3F6daTN8N5c74zNVpj3K3ey5bxSKKdVo4GHMu21yL/e1dNAexnyblV9 Q== X-Received: by 2002:a17:90b:4a81:b0:381:a766:efcb with SMTP id 98e67ed59e1d1-395c34fed98mr20373056a91.4.1787397795327; Sat, 22 Aug 2026 04:23:15 -0700 (PDT) Received: from Default ([2409:40f4:101e:d886:7c8f:61d9:4c4d:7b7]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-327f909c6c9sm7100379eec.6.2026.08.22.04.23.08 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 22 Aug 2026 04:23:14 -0700 (PDT) From: Jeffin Philip To: mchehab@kernel.org Cc: kees@kernel.org, hverkuil+cisco@kernel.org, ribalda@chromium.org, sakari.ailus@linux.intel.com, linma@zju.edu.cn, linux-media@vger.kernel.org, linux-kernel@vger.kernel.org, syzbot+37578f730d38898f4b74@syzkaller.appspotmail.com, Jeffin Philip , stable@vger.kernel.org Subject: [PATCH] media: dvbdev: fix uaf in dvb_remove_device() Date: Sat, 22 Aug 2026 16:52:56 +0530 Message-ID: <20260822112256.12346-1-jeffinphilip14@gmail.com> X-Mailer: git-send-email 2.55.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit In dvb_remove_device(), dvb_media_device_free(), device_destroy() and list_del() all dereference dvbdev regardless of its refcount. Thus, if refcount for dvbdev is 1, it can be freed and we operate on freed memory causing a UAF. Fix this by moving dvb_device_put() at the end of dvb_remove_device() so dvbdev members can be safely freed and assigned NULL when dvbdev is alive. Reported-by: syzbot+37578f730d38898f4b74@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=37578f730d38898f4b74 Fixes: 0fc044b2b5e2 ("media: dvbdev: adopts refcnt to avoid UAF") Cc: stable@vger.kernel.org Signed-off-by: Jeffin Philip --- drivers/media/dvb-core/dvbdev.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/media/dvb-core/dvbdev.c b/drivers/media/dvb-core/dvbdev.c index d753d329502a..9aa4b8fd7379 100644 --- a/drivers/media/dvb-core/dvbdev.c +++ b/drivers/media/dvb-core/dvbdev.c @@ -598,7 +598,6 @@ void dvb_remove_device(struct dvb_device *dvbdev) down_write(&minor_rwsem); dvb_minors[dvbdev->minor] = NULL; - dvb_device_put(dvbdev); up_write(&minor_rwsem); dvb_media_device_free(dvbdev); @@ -606,6 +605,8 @@ void dvb_remove_device(struct dvb_device *dvbdev) device_destroy(dvb_class, MKDEV(DVB_MAJOR, dvbdev->minor)); list_del(&dvbdev->list_head); + + dvb_device_put(dvbdev); } EXPORT_SYMBOL(dvb_remove_device); -- 2.55.0