Received: by 2002:ab2:6857:0:b0:1ef:ffd0:ce49 with SMTP id l23csp2397428lqp; Sun, 24 Mar 2024 17:44:06 -0700 (PDT) X-Forwarded-Encrypted: i=3; AJvYcCWUgJAQkyM+capAV47rwqcpYFbMuP5wt36jk7ye3vkm0O4VeweGX1dDV7JgnRThhrlexeTIpgGaP03jIraGItpjhO5zlzUanexoogkPLA== X-Google-Smtp-Source: AGHT+IEIdiIEMRGGdl/QmCIsYHMu0Am+/DB5M9RSQEJHZI2CclLlFRIqHgrngLDrg3NHj7C6Neag X-Received: by 2002:a17:907:20a9:b0:a49:dfe7:834f with SMTP id pw9-20020a17090720a900b00a49dfe7834fmr1047920ejb.59.1711327446771; Sun, 24 Mar 2024 17:44:06 -0700 (PDT) ARC-Seal: i=2; a=rsa-sha256; t=1711327446; cv=pass; d=google.com; s=arc-20160816; b=0gH4XxwH6jQa1jw3cbu4B1E9JAPGFWjZOP9uQ5KtiYg7BSChb+uPO9e3dPwCXYziyo r1kdZmS1DqV+inYZKhrInctZl3ndLbQu2wo4fKEXO/tYYcP1BBij68A8VGsPLHE6AVLA n3kYR9uAnlb8xz/l/9A65+Cs++Mq757HYhYvqLHmZ9XtZK3qbijZAiYUWEadeFjamXut l0hI2up7YsESPYt/BMzlaZw83pHUFT11n9mccY15n2jzR85YJ3E0OHic+BwPIQKYrlcg W5b7eJ3O4MpWAY3sbaYacj6Q4wq4kktvmsGXYMil5YeF114Yrt+XUDKo3zjUVOZKnngx k0CA== ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=content-transfer-encoding:mime-version:list-unsubscribe :list-subscribe:list-id:precedence:references:in-reply-to:message-id :date:subject:cc:to:from:dkim-signature; bh=WNL0rUTF2Sx57O0robQfhS85wzWPEiQu+WzDjIjOxgI=; fh=wBlClhHe9ApUJcqJYJZjbuTnnc9ebY8Iodj2h0RFj28=; b=N4d/K6CyQSsw9s8+gaaaIXMgBRBgOiKKeU+I5zwSMLnxx/5Kn7l1CW9QFocrksTaBP 8xOllDaPU0TeZXD11Amy8nOEsesiaxxD71J0KLEqLqbM+vUB6YacE37vZJR4eo8TOQbc OkqkCmfUoHn40mezT74cQyJKzCNlcpjordEAMBFs6LhxxYT6ezpZ6cZERsZ/9lTFqJP4 HuH6YgiP6xoq6pdQMvLKTVHrc/SLUf/wRrZ9amNEviGDMGv9fr0Ga6Q2S0rciVtXlwn8 uCCUC/RqV3miiUBDT1mQe0DbXsjGSBJXOGxM4I2U199clu0mqlLODKKO0cJBYJHjFpbC x2kw==; dara=google.com ARC-Authentication-Results: i=2; mx.google.com; dkim=pass header.i=@kernel.org header.s=k20201202 header.b=FAwI26cO; arc=pass (i=1 dkim=pass dkdomain=kernel.org); spf=pass (google.com: domain of linux-kernel+bounces-113380-linux.lists.archive=gmail.com@vger.kernel.org designates 147.75.80.249 as permitted sender) smtp.mailfrom="linux-kernel+bounces-113380-linux.lists.archive=gmail.com@vger.kernel.org"; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=kernel.org Return-Path: Received: from am.mirrors.kernel.org (am.mirrors.kernel.org. [147.75.80.249]) by mx.google.com with ESMTPS id l5-20020a170906644500b00a46a9c44377si2123431ejn.675.2024.03.24.17.44.06 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 24 Mar 2024 17:44:06 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel+bounces-113380-linux.lists.archive=gmail.com@vger.kernel.org designates 147.75.80.249 as permitted sender) client-ip=147.75.80.249; Authentication-Results: mx.google.com; dkim=pass header.i=@kernel.org header.s=k20201202 header.b=FAwI26cO; arc=pass (i=1 dkim=pass dkdomain=kernel.org); spf=pass (google.com: domain of linux-kernel+bounces-113380-linux.lists.archive=gmail.com@vger.kernel.org designates 147.75.80.249 as permitted sender) smtp.mailfrom="linux-kernel+bounces-113380-linux.lists.archive=gmail.com@vger.kernel.org"; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=kernel.org Received: from smtp.subspace.kernel.org (wormhole.subspace.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by am.mirrors.kernel.org (Postfix) with ESMTPS id 195481F26D75 for ; Mon, 25 Mar 2024 00:22:38 +0000 (UTC) Received: from localhost.localdomain (localhost.localdomain [127.0.0.1]) by smtp.subspace.kernel.org (Postfix) with ESMTP id 88ADB1A03AC; Sun, 24 Mar 2024 22:43:02 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="FAwI26cO" Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A0BFE19FD9D; Sun, 24 Mar 2024 22:43:01 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1711320181; cv=none; b=WqrziKKOvvj0J7jyaotl6kusfL1cHOt8WbZgyGZulR8mcZ//M3Hel5MBGehXLaB80CTrwyThtzJGICW4lCdSoYv5MdK02Z5z6r7MUVlJaLlXL11cvTTmyxn9zfOI9KBkgYiMCK+bRreH8ySHSp7KMcFIEsj+1HhMfOfMjLfSdqs= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1711320181; c=relaxed/simple; bh=zIzrS9FnuADVM5W+mS2X8Ece0Bn7nG81SCezXMUw+EM=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=oTwwOqsQx36Ow34ykn8aOF555so4PU8XpQuM73UbUexPscAlN7sPHvw1G/aEWMRMSeJWGYVjesTd/ryzeyh8P06rVdXSjJiFhKdN+38y/JXJ5zqrxckzFVUoqEGK2vsogzRmNcdVJz3a6olCUa9yLJN9TjFH4lOatPcwTop90YE= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=FAwI26cO; arc=none smtp.client-ip=10.30.226.201 Received: by smtp.kernel.org (Postfix) with ESMTPSA id C597CC433C7; Sun, 24 Mar 2024 22:43:00 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1711320181; bh=zIzrS9FnuADVM5W+mS2X8Ece0Bn7nG81SCezXMUw+EM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=FAwI26cOsLmQAjbR9nNxFmviLUQ/5szya/7BMuF/MIm5qhr0xsDkg7lzqcPEzvhj7 DLlaIgAWMKgD/+sDj2qe1t7j/TIWBUUoPrUjSuMj1wKaiTm52/fiKLcXj4EimBLetc xlTigWuvfUXPARr4/oSDloiWgvjh19sk4Syy/ZO3ZioTuw1EtcgpAD0JuyrKCTcSXW OZrprOKDaeVyIbfYaBUPxtgTk+sYpBMX7GbB0Z03oL2B39RnFEeEdtk1ovlhW6j2Za DPkvCoQYH7IJBI/CpwSlCcMh0HGoqffIu8EdwT8LyWZgTYRZiBtCUCmz7WTAr5NAXq gNF30sUqhlzXQ== From: Sasha Levin To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Edward Adam Davis , syzbot+ce750e124675d4599449@syzkaller.appspotmail.com, Hans Verkuil , Sasha Levin Subject: [PATCH 6.8 489/715] media: pvrusb2: fix uaf in pvr2_context_set_notify Date: Sun, 24 Mar 2024 18:31:08 -0400 Message-ID: <20240324223455.1342824-490-sashal@kernel.org> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20240324223455.1342824-1-sashal@kernel.org> References: <20240324223455.1342824-1-sashal@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-stable: review X-Patchwork-Hint: Ignore Content-Transfer-Encoding: 8bit From: Edward Adam Davis [ Upstream commit 0a0b79ea55de8514e1750884e5fec77f9fdd01ee ] [Syzbot reported] BUG: KASAN: slab-use-after-free in pvr2_context_set_notify+0x2c4/0x310 drivers/media/usb/pvrusb2/pvrusb2-context.c:35 Read of size 4 at addr ffff888113aeb0d8 by task kworker/1:1/26 CPU: 1 PID: 26 Comm: kworker/1:1 Not tainted 6.8.0-rc1-syzkaller-00046-gf1a27f081c1f #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/25/2024 Workqueue: usb_hub_wq hub_event Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xd9/0x1b0 lib/dump_stack.c:106 print_address_description mm/kasan/report.c:377 [inline] print_report+0xc4/0x620 mm/kasan/report.c:488 kasan_report+0xda/0x110 mm/kasan/report.c:601 pvr2_context_set_notify+0x2c4/0x310 drivers/media/usb/pvrusb2/pvrusb2-context.c:35 pvr2_context_notify drivers/media/usb/pvrusb2/pvrusb2-context.c:95 [inline] pvr2_context_disconnect+0x94/0xb0 drivers/media/usb/pvrusb2/pvrusb2-context.c:272 Freed by task 906: kasan_save_stack+0x33/0x50 mm/kasan/common.c:47 kasan_save_track+0x14/0x30 mm/kasan/common.c:68 kasan_save_free_info+0x3f/0x60 mm/kasan/generic.c:640 poison_slab_object mm/kasan/common.c:241 [inline] __kasan_slab_free+0x106/0x1b0 mm/kasan/common.c:257 kasan_slab_free include/linux/kasan.h:184 [inline] slab_free_hook mm/slub.c:2121 [inline] slab_free mm/slub.c:4299 [inline] kfree+0x105/0x340 mm/slub.c:4409 pvr2_context_check drivers/media/usb/pvrusb2/pvrusb2-context.c:137 [inline] pvr2_context_thread_func+0x69d/0x960 drivers/media/usb/pvrusb2/pvrusb2-context.c:158 [Analyze] Task A set disconnect_flag = !0, which resulted in Task B's condition being met and releasing mp, leading to this issue. [Fix] Place the disconnect_flag assignment operation after all code in pvr2_context_disconnect() to avoid this issue. Reported-and-tested-by: syzbot+ce750e124675d4599449@syzkaller.appspotmail.com Fixes: e5be15c63804 ("V4L/DVB (7711): pvrusb2: Fix race on module unload") Signed-off-by: Edward Adam Davis Signed-off-by: Hans Verkuil Signed-off-by: Sasha Levin --- drivers/media/usb/pvrusb2/pvrusb2-context.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/media/usb/pvrusb2/pvrusb2-context.c b/drivers/media/usb/pvrusb2/pvrusb2-context.c index 58f2f3ff10ee2..73c95ba2328a4 100644 --- a/drivers/media/usb/pvrusb2/pvrusb2-context.c +++ b/drivers/media/usb/pvrusb2/pvrusb2-context.c @@ -267,9 +267,9 @@ static void pvr2_context_exit(struct pvr2_context *mp) void pvr2_context_disconnect(struct pvr2_context *mp) { pvr2_hdw_disconnect(mp->hdw); - mp->disconnect_flag = !0; if (!pvr2_context_shutok()) pvr2_context_notify(mp); + mp->disconnect_flag = !0; } -- 2.43.0