Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Message-ID: <ccedda97-ed68-9453-30d3-24506d771b44@xs4all.nl>
Date:   Thu, 19 Jan 2023 08:46:39 +0100
MIME-Version: 1.0
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101
 Thunderbird/102.6.0
Subject: Re: [PATCH] media:cec:fix double free and uaf issue when cancel data
 during noblocking
Content-Language: en-US
To:     Xinghui Li <korantwork@gmail.com>, mchehab@kernel.org
Cc:     linux-kernel@vger.kernel.org, linux-media@vger.kernel.org,
        Xinghui Li <korantli@tencent.com>, loydlv <loydlv@tencent.com>
References: <20230111123712.160882-1-korantwork@gmail.com>
 <b1a8593b-b4f3-b943-39db-ed17679e32cb@xs4all.nl>
 <4D54942F-92F0-429D-9F54-3D8F7705D576@gmail.com>
From:   Hans Verkuil <hverkuil-cisco@xs4all.nl>
In-Reply-To: <4D54942F-92F0-429D-9F54-3D8F7705D576@gmail.com>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Precedence: bulk

On 19/01/2023 05:49, Xinghui Li wrote:
> 在 2023/1/18 18:18，“Hans Verkuil”<hverkuil-cisco@xs4all.nl <mailto:hverkuil-cisco@xs4all.nl>> 写入:
> 
>> ...while this free is called if data->blocking is true. (see the 'if (!block) return 0;'
>> further up).
> Do you mean this code?
> 
> 	/* All done if we don't need to block waiting for completion */
> 	if (!block)
> 		return 0;

Yes.

> I notice this part code. But I'm not sure if 'block' will be modified in other sync operations. 
> So I sent this patch for community to review.

It's not modified anywhere else.

> 
>> So I have my doubts if this patch actually addresses the correct issue.
>> Do you have an actual debug trace of the UAF? Or even better, code to reproduce
>> this issue.
> 
> And we found this issue by the code scanning tool developed by loydlv and filtered from 200 issue by human.
> So it could be the none-issue. If so, I hope I didn't waste too much of your time.

I'll reject this patch since I believe this to be a false report. For future reference:
if a patch is based on code scanning tools then it's good to mention that in the commit
log. I wasn't aware that 'loydlv' is such a tool.

Regards,

	Hans