Received: by 2002:a05:6a10:1287:0:0:0:0 with SMTP id d7csp3752862pxv; Mon, 19 Jul 2021 07:59:57 -0700 (PDT) X-Google-Smtp-Source: ABdhPJwM//fw3BqVgJswSEgzTivbcFEN3W9w5dp0bE7wqCzi0gvQWVLU9lEgRo5zwRJ+sWhjK2qp X-Received: by 2002:a6b:2bd6:: with SMTP id r205mr19497479ior.122.1626706797290; Mon, 19 Jul 2021 07:59:57 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1626706797; cv=none; d=google.com; s=arc-20160816; b=IBlZHzWIDt/0VUp3ueI+lwAOT3MsuUwBNduE/Cfb6hIgU/92iOYuFc7941OS8L+MPY oxlZ4HD1JTsYa/+SidKADgmskYzPR0yNlfyV1vEXgHdpwcKp/m5pFgmYK0h9qJ3YBL06 anWO/myovmAFPyUdPUkJM44wm1ObprEm7caXaLfIq2921n7OT2NJ8351+a2Qk5ohMZAh YACZvxT+0Q3/TmVBjyntaufglhPwbTdHZa23Cd9/5IVUkGSDAVKblnkktGOaDJzCpJ+X H1MVRr2rnLdW/Kj/z8nghwBAQbiRMOQrxI2egR9jWP1aOe9U7kwTnWdJQhMhEAZFYmRF aVPA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=3Pug2KIjnJpRWTeYh4GPnGnK4OlCXWNrO2bOU2noT/8=; b=v/U2VThCjLfIayZzW1SmytXghsFwrY8bbDeUUMIr6xXDvOyvHRYoC+eWCUTQm5t5ql Mq/9UDaP9+/kWG89/WXTUGNVwhJyTBuFu8m+Nr0+i1IVANEQm3Qz1t+9au6wq20az/qf cSe2HWaep2OnGTYgdfCYapiL7sP/1/i6i7LDPnqyiLOrKrOaF2gVIgDwidMZJd/XRiRu 3xSMU9eocmCaJjymW73aGO8KRFmV4quIIEVD7ZxgoT+8w8deGY9py/3TzpEPV8ndY0eB XzYzijFzeVtxvzOJM8eB9aQ0liPViqU6lfZODikLX0fmYoPKdYCXpBOFsceYTSJUjp1x P/6w== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=DCE4v99k; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [23.128.96.18]) by mx.google.com with ESMTP id c6si22041762jab.33.2021.07.19.07.59.45; Mon, 19 Jul 2021 07:59:57 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18; Authentication-Results: mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=DCE4v99k; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S241733AbhGSORD (ORCPT + 99 others); Mon, 19 Jul 2021 10:17:03 -0400 Received: from mail.kernel.org ([198.145.29.99]:49004 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S241676AbhGSOQo (ORCPT ); Mon, 19 Jul 2021 10:16:44 -0400 Received: by mail.kernel.org (Postfix) with ESMTPSA id B7B24610F7; Mon, 19 Jul 2021 14:57:23 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1626706644; bh=FSyh4ATv5z5J1QHnSLtm7oz7ME9uM7NWV2nCpkUkoMM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=DCE4v99kvHHI5bgHYN30sV8Hp07i/7mLN6HhWpX6L77TMVKK+B9kvCA+mNzre9st3 /SWi0PEIKDdvBTT0n4JsNqFOh/ld1//0m2BvMg9oqleYwtEbeVQTScN0VLCnqKtBt2 PgKq7zH43TkSh2h3afWqigV95ifeor55wa7VB7b4= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Lv Yunlong , Hans Verkuil , Mauro Carvalho Chehab , Sasha Levin Subject: [PATCH 4.4 034/188] media: v4l2-core: Avoid the dangling pointer in v4l2_fh_release Date: Mon, 19 Jul 2021 16:50:18 +0200 Message-Id: <20210719144921.033366722@linuxfoundation.org> X-Mailer: git-send-email 2.32.0 In-Reply-To: <20210719144913.076563739@linuxfoundation.org> References: <20210719144913.076563739@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Lv Yunlong [ Upstream commit 7dd0c9e547b6924e18712b6b51aa3cba1896ee2c ] A use after free bug caused by the dangling pointer filp->privitate_data in v4l2_fh_release. See https://lore.kernel.org/patchwork/patch/1419058/. My patch sets the dangling pointer to NULL to provide robust. Signed-off-by: Lv Yunlong Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Sasha Levin --- drivers/media/v4l2-core/v4l2-fh.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/media/v4l2-core/v4l2-fh.c b/drivers/media/v4l2-core/v4l2-fh.c index 1d076deb05a9..ce844ecc3340 100644 --- a/drivers/media/v4l2-core/v4l2-fh.c +++ b/drivers/media/v4l2-core/v4l2-fh.c @@ -107,6 +107,7 @@ int v4l2_fh_release(struct file *filp) v4l2_fh_del(fh); v4l2_fh_exit(fh); kfree(fh); + filp->private_data = NULL; } return 0; } -- 2.30.2