Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
User-Agent: Microsoft-MacOutlook/16.69.23010700
Date:   Thu, 19 Jan 2023 12:49:23 +0800
Subject: Re: [PATCH] media:cec:fix double free and uaf issue when cancel data
 during noblocking
From:   Xinghui Li <korantwork@gmail.com>
To:     Hans Verkuil <hverkuil-cisco@xs4all.nl>, <mchehab@kernel.org>
CC:     <linux-kernel@vger.kernel.org>, <linux-media@vger.kernel.org>,
        Xinghui Li <korantli@tencent.com>, loydlv <loydlv@tencent.com>
Message-ID: <4D54942F-92F0-429D-9F54-3D8F7705D576@gmail.com>
Thread-Topic: [PATCH] media:cec:fix double free and uaf issue when cancel data
 during noblocking
References: <20230111123712.160882-1-korantwork@gmail.com>
 <b1a8593b-b4f3-b943-39db-ed17679e32cb@xs4all.nl>
In-Reply-To: <b1a8593b-b4f3-b943-39db-ed17679e32cb@xs4all.nl>
Mime-version: 1.0
Content-type: text/plain;
        charset="UTF-8"
Content-transfer-encoding: quoted-printable
Precedence: bulk

=E5=9C=A8 2023/1/18 18:18=EF=BC=8C=E2=80=9CHans Verkuil=E2=80=9D<hverkuil-cisco@xs4all.nl <mailto:h=
verkuil-cisco@xs4all.nl>> =E5=86=99=E5=85=A5:

>...while this free is called if data->blocking is true. (see the 'if (!blo=
ck) return 0;'
>further up).
Do you mean this code?

	/* All done if we don't need to block waiting for completion */
	if (!block)
		return 0;
I notice this part code. But I'm not sure if 'block' will be modified in ot=
her sync operations.=20
So I sent this patch for community to review.

>So I have my doubts if this patch actually addresses the correct issue.
>Do you have an actual debug trace of the UAF? Or even better, code to repr=
oduce
>this issue.

And we found this issue by the code scanning tool developed by loydlv and f=
iltered from 200 issue by human.
So it could be the none-issue. If so, I hope I didn't waste too much of you=
r time. __