kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-22 19:14:51 +00:00
Code Issues Releases Packages Activity
No description
1,078,162 commits 117 branches 5,803 tags 5.7 GiB
  • C 96.8%
  • Assembly 0.9%
  • Rust 0.7%
  • Shell 0.6%
  • Python 0.5%
  • Other 0.3%
Find a file
Jeongjun Park 131ec9046e media: hackrf: fix to not free memory after the device is registered in hackrf_probe() 
commit 3b7da2b4d0 upstream.

In hackrf driver, the following race condition occurs:
```
		CPU0						CPU1
hackrf_probe()
  kzalloc(); // alloc hackrf_dev
  ....
  v4l2_device_register();
  ....
						fd = sys_open("/path/to/dev"); // open hackrf fd
						....
  v4l2_device_unregister();
  ....
  kfree(); // free hackrf_dev
  ....
						sys_ioctl(fd, ...);
						  v4l2_ioctl();
						    video_is_registered() // UAF!!
						....
						sys_close(fd);
						  v4l2_release() // UAF!!
						    hackrf_video_release()
						      kfree(); // DFB!!
```

When a V4L2 or video device is unregistered, the device node is removed so
new open() calls are blocked.

However, file descriptors that are already open-and any in-flight I/O-do
not terminate immediately; they remain valid until the last reference is
dropped and the driver's release() is invoked.

Therefore, freeing device memory on the error path after hackrf_probe()
has registered dev it will lead to a race to use-after-free vuln, since
those already-open handles haven't been released yet.

And since release() free memory too, race to use-after-free and
double-free vuln occur.

To prevent this, if device is registered from probe(), it should be
modified to free memory only through release() rather than calling
kfree() directly.

Cc: <stable@vger.kernel.org>
Reported-by: syzbot+6ffd76b5405c006a46b7@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=6ffd76b5405c006a46b7
Reported-by: syzbot+f1b20958f93d2d250727@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=f1b20958f93d2d250727
Fixes: 8bc4a9ed85 ("[media] hackrf: add support for transmitter")
Signed-off-by: Jeongjun Park <aha310510@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
History 2026-06-01 17:35:06 +02:00
arch KVM: x86: Use scratch field in MMIO fragment to hold small write values 2026-06-01 17:35:06 +02:00
block blk-mq-debugfs: add missing debugfs_mutex in blk_mq_debugfs_register_hctxs() 2026-03-04 07:19:59 -05:00
certs certs/blacklist_hashes.c: fix const confusion in certs blacklist 2022-06-22 14:22:01 +02:00
crypto crypto: algif_aead - Fix minimum RX size check for decryption 2026-04-30 11:24:38 +02:00
Documentation dt-bindings: auxdisplay: ht16k33: Use unevaluatedProperties to fix common property warning 2026-04-18 10:33:29 +02:00
drivers media: hackrf: fix to not free memory after the device is registered in hackrf_probe() 2026-06-01 17:35:06 +02:00
fs nilfs2: fix NULL i_assoc_inode dereference in nilfs_mdt_save_to_shadow_map 2026-06-01 17:35:06 +02:00
include KVM: x86: Use scratch field in MMIO fragment to hold small write values 2026-06-01 17:35:06 +02:00
init init: handle bootloader identifier in kernel parameters 2025-10-19 16:21:45 +02:00
io_uring io_uring/poll: correctly handle io_poll_add() return value on update 2026-04-18 10:33:39 +02:00
ipc ipc: fix to protect IPCS lookups using RCU 2025-06-27 11:05:26 +01:00
kernel tracing/probe: reject non-closed empty immediate strings 2026-06-01 17:35:02 +02:00
lib netlink: add nla be16/32 types to minlen array 2026-04-18 10:33:37 +02:00
LICENSES LICENSES/dual/CC-BY-4.0: Git rid of "smart quotes" 2021-07-15 06:31:24 -06:00
mm mm/kasan: fix double free for kasan pXds 2026-06-01 17:35:06 +02:00
net rxrpc: proc: size address buffers for %pISpc output 2026-06-01 17:35:06 +02:00
samples samples: mei: Fix building on musl libc 2025-08-28 16:24:07 +02:00
scripts checkpatch: add support for Assisted-by tag 2026-06-01 17:35:06 +02:00
security apparmor: fix race between freeing data and fs accessing it 2026-04-18 10:33:36 +02:00
sound ALSA: 6fire: fix use-after-free on disconnect 2026-06-01 17:35:06 +02:00
tools x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache 2026-05-15 14:48:45 +02:00
usr kbuild: hdrcheck: fix cross build with clang 2025-06-27 11:05:22 +01:00
virt KVM: Don't clobber irqfd routing type when deassigning irqfd 2026-02-11 13:35:27 +01:00
.clang-format clang-format: Update with the latest for_each macro list 2021-05-12 23:32:39 +02:00
.cocciconfig scripts: add Linux .cocciconfig for coccinelle 2016-07-22 12:13:39 +02:00
.get_maintainer.ignore Opt out of scripts/get_maintainer.pl 2019-05-16 10:53:40 -07:00
.gitattributes .gitattributes: use 'dts' diff driver for dts files 2019-12-04 19:44:11 -08:00
.gitignore Remove *.orig pattern from .gitignore 2024-10-17 15:11:10 +02:00
.mailmap mailmap: add Andrej Shadura 2021-10-18 20:22:03 -10:00
COPYING COPYING: state that all contributions really are covered by this file 2020-02-10 13:32:20 -08:00
CREDITS MAINTAINERS: Move Daniel Drake to credits 2021-09-21 08:34:58 +03:00
Kbuild kbuild: rename hostprogs-y/always to hostprogs/always-y 2020-02-04 01:53:07 +09:00
Kconfig kbuild: ensure full rebuild when the compiler is updated 2020-05-12 13:28:33 +09:00
MAINTAINERS staging: rtl8712: Remove driver using deprecated API wext 2025-12-07 06:09:36 +09:00
Makefile Linux 5.15.208 2026-05-23 13:40:45 +02:00
README Drop all 00-INDEX files from Documentation/ 2018-09-09 15:08:58 -06:00

README 

Linux kernel
============

There are several guides for kernel developers and users. These guides can
be rendered in a number of formats, like HTML and PDF. Please read
Documentation/admin-guide/README.rst first.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.  The formatted documentation can also be read online at:

    https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory,
several of them using the Restructured Text markup notation.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.