Messages in this thread | | | Date | Fri, 7 Jul 2023 16:11:32 +0200 | Subject | Re: [RESEND PATCH v2] media: mtk-jpeg: Fix use after free bug due to uncanceled work | From | Alexandre Mergnat <> |
| |
On 07/07/2023 11:24, Zheng Wang wrote: > In mtk_jpeg_probe, &jpeg->job_timeout_work is bound with > mtk_jpeg_job_timeout_work. Then mtk_jpeg_dec_device_run > and mtk_jpeg_enc_device_run may be called to start the > work. > If we remove the module which will call mtk_jpeg_remove > to make cleanup, there may be a unfinished work. The > possible sequence is as follows, which will cause a > typical UAF bug. > > Fix it by canceling the work before cleanup in the mtk_jpeg_remove > > CPU0 CPU1 > > |mtk_jpeg_job_timeout_work > mtk_jpeg_remove | > v4l2_m2m_release | > kfree(m2m_dev); | > | > | v4l2_m2m_get_curr_priv > | m2m_dev->curr_ctx //use
Reviewed-by: Alexandre Mergnat <amergnat@baylibre.com>
-- Regards, Alexandre
| |