Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Date:   Wed, 16 Nov 2022 05:19:28 -0800
From:   Hyunwoo Kim <imv4bel@gmail.com>
To:     Salvatore Bonaccorso <carnil@debian.org>
Cc:     Takashi Iwai <tiwai@suse.de>,
        Mauro Carvalho Chehab <mchehab@kernel.org>,
        linux-media@vger.kernel.org, linux-kernel@vger.kernel.org,
        imv4bel@gmail.com
Subject: Re: [PATCH] media: dvb-core: Fix UAF due to refcount races at
 releasing
Message-ID: <20221116131928.GA7144@ubuntu>
References: <20220908132754.30532-1-tiwai@suse.de>
 <87sfklgozd.wl-tiwai@suse.de>
 <87k056dekm.wl-tiwai@suse.de>
 <Y3TEk7Nr3yAQIozQ@eldamar.lan>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <Y3TEk7Nr3yAQIozQ@eldamar.lan>
Precedence: bulk

Hi,

On Wed, Nov 16, 2022 at 12:08:03PM +0100, Salvatore Bonaccorso wrote:
> Hi,
> 
> On Tue, Oct 11, 2022 at 09:06:33AM +0200, Takashi Iwai wrote:
> > On Wed, 21 Sep 2022 09:34:30 +0200,
> > Takashi Iwai wrote:
> > > 
> > > On Thu, 08 Sep 2022 15:27:54 +0200,
> > > Takashi Iwai wrote:
> > > > 
> > > > The dvb-core tries to sync the releases of opened files at
> > > > dvb_dmxdev_release() with two refcounts: dvbdev->users and
> > > > dvr_dvbdev->users.  A problem is present in those two syncs: when yet
> > > > another dvb_demux_open() is called during those sync waits,
> > > > dvb_demux_open() continues to process even if the device is being
> > > > closed.  This includes the increment of the former refcount, resulting
> > > > in the leftover refcount after the sync of the latter refcount at
> > > > dvb_dmxdev_release().  It ends up with use-after-free, since the
> > > > function believes that all usages were gone and releases the
> > > > resources.
> > > > 
> > > > This patch addresses the problem by adding the check of dmxdev->exit
> > > > flag at dvb_demux_open(), just like dvb_dvr_open() already does.  With
> > > > the exit flag check, the second call of dvb_demux_open() fails, hence
> > > > the further corruption can be avoided.
> > > > 
> > > > Also for avoiding the races of the dmxdev->exit flag reference, this
> > > > patch serializes the dmxdev->exit set up and the sync waits with the
> > > > dmxdev->mutex lock at dvb_dmxdev_release().  Without the mutex lock,
> > > > dvb_demux_open() (or dvb_dvr_open()) may run concurrently with
> > > > dvb_dmxdev_release(), which allows to skip the exit flag check and
> > > > continue the open process that is being closed.
> > > > 
> > > > Reported-by: Hyunwoo Kim <imv4bel@gmail.com>
> > > > Cc: <stable@vger.kernel.org>
> > > > Signed-off-by: Takashi Iwai <tiwai@suse.de>
> > > 
> > > Any review on this?
> > > 
> > > FWIW, now CVE-2022-41218 is assigned for those bugs as a security
> > > issue.
> > 
> > A gentle ping again.
> > 
> > Or if any other fix for this security issue is already available,
> > please let me know.
> 
> is this correct, the fix is yet missing (or was it fixed by other
> means?).

This patch has been re-send and has been missing for a long time:
https://lore.kernel.org/linux-media/20221031100245.23702-1-tiwai@suse.de/

However, I noticed yesterday that the status of the re-send patch 
changed to 'accpet':
https://patchwork.linuxtv.org/project/linux-media/patch/20221031100245.23702-1-tiwai@suse.de/

But there was no other feedback.


Regards,
Hyunwoo Kim