Messages in this thread | | | From | Zheng Hacker <> | Date | Sun, 16 Jul 2023 00:08:33 +0800 | Subject | Re: [RESEND PATCH v2] media: mtk-jpeg: Fix use after free bug due to uncanceled work |
| |
Hi,
This issue has not been resolved for a long time. Is there anyone who can help?
Best regards, Zheng
Alexandre Mergnat <amergnat@baylibre.com> 于2023年7月7日周五 22:11写道: > > > > On 07/07/2023 11:24, Zheng Wang wrote: > > In mtk_jpeg_probe, &jpeg->job_timeout_work is bound with > > mtk_jpeg_job_timeout_work. Then mtk_jpeg_dec_device_run > > and mtk_jpeg_enc_device_run may be called to start the > > work. > > If we remove the module which will call mtk_jpeg_remove > > to make cleanup, there may be a unfinished work. The > > possible sequence is as follows, which will cause a > > typical UAF bug. > > > > Fix it by canceling the work before cleanup in the mtk_jpeg_remove > > > > CPU0 CPU1 > > > > |mtk_jpeg_job_timeout_work > > mtk_jpeg_remove | > > v4l2_m2m_release | > > kfree(m2m_dev); | > > | > > | v4l2_m2m_get_curr_priv > > | m2m_dev->curr_ctx //use > > Reviewed-by: Alexandre Mergnat <amergnat@baylibre.com> > > -- > Regards, > Alexandre
| |