Re: [RFC PATCH] media: vidtv: fix uaf in vidtv_bridge_on_new_pkts_avail

[Jeffin Philip <jeffinphilip14@gmail.com>]

>Attempting to unbind a dvbdevice that is in the process of feeding
>data causes a UAF as we free the underlying device without
>stopping the feed first. Fix this by stopping the stream first using
>vidtv_stop_streaming(). However, our codepath in the reproducer
>(mentioned in the below reply) does not decrement our users
>(dmxdev->dvr_dvbdev->users) to 1 after it has been incremented to 2
>by our read() in the reproducer, that is only possible on .release.
>This can cause a task hang as dvb_dmxdev_release() uses wait_event()
>in the wait_queue unless we use a close(fd)(in the reproducer).
>Is this a problem? Please advise.

Reproducer:

#include <fcntl.h>
#include <unistd.h>
#include <pthread.h>
#include <linux/dvb/dmx.h>
#include <sys/ioctl.h>

static void *feed_thread(void *arg)
{
    int i = 100;
    int fd = open("/dev/dvb/adapter0/demux0", O_RDWR | O_NONBLOCK);
    struct dmx_sct_filter_params params = {
        .pid = 0,
        .filter = { .filter = {0}, .mask = {0} },
        .flags = DMX_IMMEDIATE_START,
    };
    ioctl(fd, DMX_SET_FILTER, &params);
    char buf[188];
    read(fd, buf, sizeof(buf));
    //no close(fd) here
    return NULL;
}

int main(void)
{
    pthread_t t;
    pthread_create(&t, NULL, feed_thread, NULL);
    sleep(1);
    int fd = open("/sys/bus/platform/drivers/vidtv/unbind", O_WRONLY);
    write(fd, "vidtv.0", 7);
    pthread_join(t, NULL);
    return 0;
}