kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-11-08 18:57:22 +00:00
Code Issues Releases Packages Activity
linux/drivers/media/tuners
History
Duoming Zhou 40b7a19f32 media: tuner: xc5000: Fix use-after-free in xc5000_release 
The original code uses cancel_delayed_work() in xc5000_release(), which
does not guarantee that the delayed work item timer_sleep has fully
completed if it was already running. This leads to use-after-free scenarios
where xc5000_release() may free the xc5000_priv while timer_sleep is still
active and attempts to dereference the xc5000_priv.

A typical race condition is illustrated below:

CPU 0 (release thread)                 | CPU 1 (delayed work callback)
xc5000_release()                       | xc5000_do_timer_sleep()
  cancel_delayed_work()                |
  hybrid_tuner_release_state(priv)     |
    kfree(priv)                        |
                                       |   priv = container_of() // UAF

Replace cancel_delayed_work() with cancel_delayed_work_sync() to ensure
that the timer_sleep is properly canceled before the xc5000_priv memory
is deallocated.

A deadlock concern was considered: xc5000_release() is called in a process
context and is not holding any locks that the timer_sleep work item might
also need. Therefore, the use of the _sync() variant is safe here.

This bug was initially identified through static analysis.

Fixes: f7a27ff1fb ("[media] xc5000: delay tuner sleep to 5 seconds")
Cc: stable@vger.kernel.org
Signed-off-by: Duoming Zhou <duoming@zju.edu.cn>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
[hverkuil: fix typo in Subject: tunner -> tuner]
History 2025-09-17 12:15:35 +02:00
..
e4000.c media: Drop explicit initialization of struct i2c_device_id::driver_data to 0 2024-08-09 07:56:37 +02:00
e4000.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 1 2019-05-21 11:28:39 +02:00
e4000_priv.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 1 2019-05-21 11:28:39 +02:00
fc001x-common.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 157 2019-05-30 11:26:37 -07:00
fc0011.c media: dvb: symbol fixup for dvb_attach() 2023-09-09 08:15:11 +01:00
fc0011.h media: move dvb kAPI headers to include/media 2017-12-28 13:16:01 -05:00
fc0012-priv.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 157 2019-05-30 11:26:37 -07:00
fc0012.c media: dvb: symbol fixup for dvb_attach() 2023-09-09 08:15:11 +01:00
fc0012.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 157 2019-05-30 11:26:37 -07:00
fc0013-priv.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 157 2019-05-30 11:26:37 -07:00
fc0013.c media: tuners: fc0013 Remove unused functions 2024-12-02 14:05:25 +01:00
fc0013.h media: tuners: fc0013 Remove unused functions 2024-12-02 14:05:25 +01:00
fc2580.c media: Drop explicit initialization of struct i2c_device_id::driver_data to 0 2024-08-09 07:56:37 +02:00
fc2580.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 1 2019-05-21 11:28:39 +02:00
fc2580_priv.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 1 2019-05-21 11:28:39 +02:00
it913x.c media: Switch back to struct platform_driver::remove() 2024-10-12 16:28:25 +02:00
it913x.h media: media tuner headers: fix kernel-doc warnings 2021-03-22 10:24:27 +01:00
Kconfig media: media/*/Kconfig: sort entries 2022-03-18 05:58:35 +01:00
m88rs6000t.c media: Drop explicit initialization of struct i2c_device_id::driver_data to 0 2024-08-09 07:56:37 +02:00
m88rs6000t.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 157 2019-05-30 11:26:37 -07:00
Makefile media: Makefiles: sort entries where it fits 2022-03-14 09:42:59 +01:00
max2165.c media: dvb: symbol fixup for dvb_attach() 2023-09-09 08:15:11 +01:00
max2165.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 157 2019-05-30 11:26:37 -07:00
max2165_priv.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 157 2019-05-30 11:26:37 -07:00
mc44s803.c media: dvb: symbol fixup for dvb_attach() 2023-09-09 08:15:11 +01:00
mc44s803.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 157 2019-05-30 11:26:37 -07:00
mc44s803_priv.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 157 2019-05-30 11:26:37 -07:00
msi001.c spi: make remove callback a void function 2022-02-09 13:00:45 +00:00
mt20xx.c treewide: Add SPDX license identifier for more missed files 2019-05-21 10:50:45 +02:00
mt20xx.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 61 2019-05-24 17:36:45 +02:00
mt2060.c media: Drop explicit initialization of struct i2c_device_id::driver_data to 0 2024-08-09 07:56:37 +02:00
mt2060.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 157 2019-05-30 11:26:37 -07:00
mt2060_priv.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 157 2019-05-30 11:26:37 -07:00
mt2063.c media:tuners: Fix typos in comments across various files 2024-10-12 16:28:25 +02:00
mt2063.h media: move dvb kAPI headers to include/media 2017-12-28 13:16:01 -05:00
mt2131.c media: dvb: symbol fixup for dvb_attach() 2023-09-09 08:15:11 +01:00
mt2131.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 157 2019-05-30 11:26:37 -07:00
mt2131_priv.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 157 2019-05-30 11:26:37 -07:00
mt2266.c media: dvb: symbol fixup for dvb_attach() 2023-09-09 08:15:11 +01:00
mt2266.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 157 2019-05-30 11:26:37 -07:00
mxl301rf.c media:tuners: Fix typos in comments across various files 2024-10-12 16:28:25 +02:00
mxl301rf.h media: tuners/mxl301rf: use SPDX License Identifier 2018-05-04 14:45:21 -04:00
mxl5005s.c media:tuners: Fix typos in comments across various files 2024-10-12 16:28:25 +02:00
mxl5005s.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 61 2019-05-24 17:36:45 +02:00
mxl5007t.c media: tuners: mxl5007t: Removed unnecessary 'return' 2021-09-30 10:07:40 +02:00
mxl5007t.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 157 2019-05-30 11:26:37 -07:00
qm1d1b0004.c media: Drop explicit initialization of struct i2c_device_id::driver_data to 0 2024-08-09 07:56:37 +02:00
qm1d1b0004.h media: tuners: fix several typos 2019-03-01 09:40:29 -05:00
qm1d1c0042.c media: Drop explicit initialization of struct i2c_device_id::driver_data to 0 2024-08-09 07:56:37 +02:00
qm1d1c0042.h media: tuners/qm1d1c0042: use SPDX License Identifier 2018-05-04 14:45:45 -04:00
qt1010.c media: dvb: symbol fixup for dvb_attach() 2023-09-09 08:15:11 +01:00
qt1010.h media: media tuner headers: fix kernel-doc warnings 2021-03-22 10:24:27 +01:00
qt1010_priv.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 157 2019-05-30 11:26:37 -07:00
r820t.c media: Print chip type explicitly when loading the Rafael Micro r820t module 2021-12-07 11:29:57 +01:00
r820t.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 1 2019-05-21 11:28:39 +02:00
si2157.c media: Switch i2c drivers back to use .probe() 2023-05-25 16:21:21 +02:00
si2157.h media: si2157: Add option for not downloading firmware. 2019-10-10 07:07:14 -03:00
si2157_priv.h media: si2157: add ATV support for si2158 2021-12-14 16:19:05 +01:00
tda827x.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 157 2019-05-30 11:26:37 -07:00
tda827x.h media: media tuner headers: fix kernel-doc warnings 2021-03-22 10:24:27 +01:00
tda8290.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 61 2019-05-24 17:36:45 +02:00
tda8290.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 61 2019-05-24 17:36:45 +02:00
tda9887.c media: tda9887: add missing MODULE_DESCRIPTION() macro 2024-06-15 10:49:20 +02:00
tda9887.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 61 2019-05-24 17:36:45 +02:00
tda18212.c media: Drop explicit initialization of struct i2c_device_id::driver_data to 0 2024-08-09 07:56:37 +02:00
tda18212.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 1 2019-05-21 11:28:39 +02:00
tda18218.c media: dvb: symbol fixup for dvb_attach() 2023-09-09 08:15:11 +01:00
tda18218.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 157 2019-05-30 11:26:37 -07:00
tda18218_priv.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 157 2019-05-30 11:26:37 -07:00
tda18250.c media: Drop explicit initialization of struct i2c_device_id::driver_data to 0 2024-08-09 07:56:37 +02:00
tda18250.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 157 2019-05-30 11:26:37 -07:00
tda18250_priv.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 157 2019-05-30 11:26:37 -07:00
tda18271-common.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 61 2019-05-24 17:36:45 +02:00
tda18271-fe.c media: tda18271: add missing result checking of tda18271_lookup_map() 2024-10-12 16:28:24 +02:00
tda18271-maps.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 61 2019-05-24 17:36:45 +02:00
tda18271-priv.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 61 2019-05-24 17:36:45 +02:00
tda18271.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 61 2019-05-24 17:36:45 +02:00
tea5761.c media:tuners: Fix typos in comments across various files 2024-10-12 16:28:25 +02:00
tea5761.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 61 2019-05-24 17:36:45 +02:00
tea5767.c media:tuners: Fix typos in comments across various files 2024-10-12 16:28:25 +02:00
tea5767.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 61 2019-05-24 17:36:45 +02:00
tua9001.c media: Drop explicit initialization of struct i2c_device_id::driver_data to 0 2024-08-09 07:56:37 +02:00
tua9001.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 157 2019-05-30 11:26:37 -07:00
tua9001_priv.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 157 2019-05-30 11:26:37 -07:00
tuner-i2c.h Revert "media: tuners: fix error return code of hybrid_tuner_request_state()" 2024-08-09 07:56:38 +02:00
tuner-simple.c media: tuners: Constify struct tunertype, tuner_range and tuner_params 2025-02-21 10:33:15 +01:00
tuner-simple.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 61 2019-05-24 17:36:45 +02:00
tuner-types.c media: tuners: Constify struct tunertype, tuner_range and tuner_params 2025-02-21 10:33:15 +01:00
xc2028-types.h media: xc2028: rename the driver from tuner-xc2028 2022-03-12 16:59:50 +01:00
xc2028.c move asm/unaligned.h to linux/unaligned.h 2024-10-02 17:23:23 -04:00
xc2028.h media: xc2028: rename the driver from tuner-xc2028 2022-03-12 16:59:50 +01:00
xc4000.c media: fix uninitialized symbol warnings 2025-08-29 11:04:02 +02:00
xc4000.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 157 2019-05-30 11:26:37 -07:00
xc5000.c media: tuner: xc5000: Fix use-after-free in xc5000_release 2025-09-17 12:15:35 +02:00
xc5000.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 157 2019-05-30 11:26:37 -07:00