diff options
| author | Jeffin Philip <jeffinphilip14@gmail.com> | 2026-08-27 09:52:29 +0530 |
|---|---|---|
| committer | Hans Verkuil <hverkuil+cisco@kernel.org> | 2026-09-08 15:07:04 +0200 |
| commit | 2af02ccd048b77713695d7817cf645ca50bf349e (patch) | |
| tree | 99db6218e250205d3b478ce03051bfc583dadedb | |
| parent | 6f412f9fe6a1f3ce9694757f50353bbec221d832 (diff) | |
| download | linux-next-2af02ccd048b77713695d7817cf645ca50bf349e.tar.gz linux-next-2af02ccd048b77713695d7817cf645ca50bf349e.zip | |
media: vidtv: fix uaf in vidtv_bridge_on_new_pkts_avail
Attempting to unbind a dvbdevice that is in the process of feeding
data causes a UAF as we free the underlying device without
stopping the feed first. Fix this by stopping the stream first using
vidtv_stop_streaming(). However, our codepath in the reproducer
(mentioned in the below reply) does not decrement our users
(dmxdev->dvr_dvbdev->users) to 1 after it has been incremented to 2
by our read() in the reproducer, that is only possible on .release.
This can cause a task hang as dvb_dmxdev_release() uses wait_event()
in the wait_queue unless we use a close(fd)(in the reproducer).
Is this a problem? Please advise.
Reported-by: syzbot+c7fc4794e59786f5b4dc@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=c7fc4794e59786f5b4dc
Fixes: f90cf6079bf6 ("media: vidtv: add a bridge driver")
Cc: stable@vger.kernel.org
Signed-off-by: Jeffin Philip <jeffinphilip14@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
| -rw-r--r-- | drivers/media/test-drivers/vidtv/vidtv_bridge.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/drivers/media/test-drivers/vidtv/vidtv_bridge.c b/drivers/media/test-drivers/vidtv/vidtv_bridge.c index 9887860b0198..f951b877ada6 100644 --- a/drivers/media/test-drivers/vidtv/vidtv_bridge.c +++ b/drivers/media/test-drivers/vidtv/vidtv_bridge.c @@ -551,6 +551,8 @@ static void vidtv_bridge_remove(struct platform_device *pdev) mutex_destroy(&dvb->feed_lock); + vidtv_stop_streaming(dvb); + for (i = 0; i < NUM_FE; ++i) { dvb_unregister_frontend(dvb->fe[i]); dvb_frontend_detach(dvb->fe[i]); |