Reference in a new issue

Blame

Copy permalink

Reference in a new issue

Copy permalink

Gui-Dong Han ed905fe7cb media: rainshadow-cec: fix TOCTOU race condition in rain_interrupt() ... commit 7af160aea2 upstream. In the interrupt handler rain_interrupt(), the buffer full check on rain->buf_len is performed before acquiring rain->buf_lock. This creates a Time-of-Check to Time-of-Use (TOCTOU) race condition, as rain->buf_len is concurrently accessed and modified in the work handler rain_irq_work_handler() under the same lock. Multiple interrupt invocations can race, with each reading buf_len before it becomes full and then proceeding. This can lead to both interrupts attempting to write to the buffer, incrementing buf_len beyond its capacity (DATA_SIZE) and causing a buffer overflow. Fix this bug by moving the spin_lock() to before the buffer full check. This ensures that the check and the subsequent buffer modification are performed atomically, preventing the race condition. An corresponding spin_unlock() is added to the overflow path to correctly release the lock. This possible bug was found by an experimental static analysis tool developed by our team. Fixes: 0f314f6c2e ("[media] rainshadow-cec: new RainShadow Tech HDMI CEC driver") Cc: stable@vger.kernel.org Signed-off-by: Gui-Dong Han <hanguidong02@gmail.com> Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		History 2025-08-28 16:31:01 +02:00
..
core	[tree-wide] finally take no_llseek out	2024-09-27 08:18:43 -07:00
i2c	media: cec: ch7322: drop of_match_ptr for ID table	2023-07-14 12:31:12 +02:00
platform	Mainly singleton patches, documented in their respective changelogs.	2024-05-19 14:02:03 -07:00
usb	media: rainshadow-cec: fix TOCTOU race condition in rain_interrupt()	2025-08-28 16:31:01 +02:00
Kconfig	media: CEC: keep related menu entries together	2021-10-05 09:39:32 +02:00
Makefile	media: cec: i2c: ch7322: Add ch7322 CEC controller driver	2020-07-04 12:16:18 +02:00