[PATCH] media: cx23885: altera-ci: drain CI status work before free

[PATCH] media: cx23885: altera-ci: drain CI status work before free

[hyunjungg]

From: Hyunjung Ko <hj351016@gmail.com>

altera_ci_irq() schedules inter->work (netup_read_ci_status) from the
cx23885 interrupt path, but nothing cancels it on teardown. The worker
netup_read_ci_status() obtains the fpga_internal via container_of() and
takes inter->fpga_mutex, so it must not outlive that structure.

On device removal cx23885_finidev() calls free_irq() and then drains only
its own works (cx25840_work, ir_rx_work, ir_tx_work) before unregistering
the device, which reaches altera_ci_release(). free_irq() waits for the
interrupt handler to finish but does not cancel a work the handler has
already scheduled, and inter->work is not among the drained works.
altera_ci_release() then frees the fpga_internal via
kfree(state->internal).

If the CI interrupt fires shortly before free_irq(), inter->work is left
queued on the system workqueue and runs after the fpga_internal has been
freed, so netup_read_ci_status() dereferences freed memory and operates on
inter->fpga_mutex in a freed structure (use-after-free).

Drain the work with cancel_work_sync() before freeing the fpga_internal, in
the final-release branch where it is about to be freed. altera_ci_release()
does not hold inter->fpga_mutex, so the drain cannot deadlock against the
handler.

The sibling NetUP CI driver cimax2.c has an identically-named
netup_read_ci_status() work and had the same use-after-free fixed in commit
4e143d662ca9 ("media: cx23885: cancel NetUP CI work before teardown");
altera-ci.c has the same pattern but was not covered by that change.

Found by static analysis and code review; not runtime-reproduced (needs a
NetUP CI card on cx23885 hardware and an interrupt racing device removal).

Fixes: 349bcf02e361 ("[media] Altera FPGA based CI driver module")
Cc: stable@vger.kernel.org
Signed-off-by: Hyunjung Ko <hj351016@gmail.com>
---
 drivers/media/pci/cx23885/altera-ci.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/media/pci/cx23885/altera-ci.c b/drivers/media/pci/cx23885/altera-ci.c
index 20a3b6c..94930e2 100644
--- a/drivers/media/pci/cx23885/altera-ci.c
+++ b/drivers/media/pci/cx23885/altera-ci.c
@@ -496,6 +496,7 @@ void altera_ci_release(void *dev, int ci_nr)
 
 			ci_dbg_print("%s: Actually removing\n", __func__);
 
+			cancel_work_sync(&temp_int->internal->work);
 			remove_inode(temp_int->internal);
 			kfree(state->internal);
 		}
-- 
2.43.0