diff options
| author | Fan Wu <fanwu01@zju.edu.cn> | 2026-08-10 05:51:28 +0000 |
|---|---|---|
| committer | Hans Verkuil <hverkuil+cisco@kernel.org> | 2026-09-08 15:10:03 +0200 |
| commit | 521030837bee352515d5ea57cc6a29581db3506e (patch) | |
| tree | cd9d5f767fd9d9ac98b0bbb62c2d721e95fc2b9c | |
| parent | 75016a992d9b03f5cc6df1414d1da35840d4feeb (diff) | |
| download | linux-next-521030837bee352515d5ea57cc6a29581db3506e.tar.gz linux-next-521030837bee352515d5ea57cc6a29581db3506e.zip | |
media: au0828: fix use-after-free in bulk_timeout timer on disconnect
start_urb_transfer() arms dev->bulk_timeout, whose callback
au0828_bulk_timeout() queues dev->restart_streaming; that work in turn
calls start_urb_transfer() and re-arms the timer.
au0828_dvb_unregister() cancels restart_streaming on disconnect but does
not sync bulk_timeout. au0828_usb_release() then frees dev with kfree(),
so a timer still armed or pending at that point can fire after the free
and dereference dev through timer_container_of().
Sync the timer with timer_shutdown_sync() before cancel_work_sync(). The
timer callback queues the work, so the timer must be stopped first; the
shutdown variant is needed because the work re-arms the timer through
start_urb_transfer(). The dvb->frontend == NULL early return guards the
register-failure path where the timer was never set up.
This bug was found by static analysis.
Fixes: 53460c53b761 ("[media] au0828: Add timer to restart TS stream if no data arrives on bulk endpoint")
Cc: stable@vger.kernel.org
Assisted-by: Codex:gpt-5.6
Signed-off-by: Fan Wu <fanwu01@zju.edu.cn>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
| -rw-r--r-- | drivers/media/usb/au0828/au0828-dvb.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/drivers/media/usb/au0828/au0828-dvb.c b/drivers/media/usb/au0828/au0828-dvb.c index 9c95b7ceaecd..d3fff47f0edf 100644 --- a/drivers/media/usb/au0828/au0828-dvb.c +++ b/drivers/media/usb/au0828/au0828-dvb.c @@ -537,6 +537,7 @@ void au0828_dvb_unregister(struct au0828_dev *dev) if (dvb->frontend == NULL) return; + timer_shutdown_sync(&dev->bulk_timeout); cancel_work_sync(&dev->restart_streaming); dvb_net_release(&dvb->net); |