Wang Hai 4d6a558bde media: dmxdev: fix UAF when dvb_register_device() fails ... [ Upstream commit ab599eb118 ] I got a use-after-free report: dvbdev: dvb_register_device: failed to create device dvb1.dvr0 (-12) ... ================================================================== BUG: KASAN: use-after-free in dvb_dmxdev_release+0xce/0x2f0 ... Call Trace: dump_stack_lvl+0x6c/0x8b print_address_description.constprop.0+0x48/0x70 kasan_report.cold+0x82/0xdb __asan_load4+0x6b/0x90 dvb_dmxdev_release+0xce/0x2f0 ... Allocated by task 7666: kasan_save_stack+0x23/0x50 __kasan_kmalloc+0x83/0xa0 kmem_cache_alloc_trace+0x22e/0x470 dvb_register_device+0x12f/0x980 dvb_dmxdev_init+0x1f3/0x230 ... Freed by task 7666: kasan_save_stack+0x23/0x50 kasan_set_track+0x20/0x30 kasan_set_free_info+0x24/0x40 __kasan_slab_free+0xf2/0x130 kfree+0xd1/0x5c0 dvb_register_device.cold+0x1ac/0x1fa dvb_dmxdev_init+0x1f3/0x230 ... When dvb_register_device() in dvb_dmxdev_init() fails, dvb_dmxdev_init() does not return a failure, and the memory pointed to by dvbdev or dvr_dvbdev is invalid at this point. If they are used subsequently, it will result in UFA or null-ptr-deref. If dvb_register_device() in dvb_dmxdev_init() fails, fix the bug by making dvb_dmxdev_init() return an error as well. Link: https://lore.kernel.org/linux-media/20211015085741.1203283-1-wanghai38@huawei.com Fixes: 1da177e4c3 ("Linux-2.6.12-rc2") Reported-by: Hulk Robot <hulkci@huawei.com> Signed-off-by: Wang Hai <wanghai38@huawei.com> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>		2022-01-27 11:03:14 +01:00
..
dmxdev.c	media: dmxdev: fix UAF when dvb_register_device() fails	2022-01-27 11:03:14 +01:00
dvb_ca_en50221.c	media: dvb_ca_en50221: avoid speculation from CA slot	2021-06-17 09:24:10 +02:00
dvb_demux.c	media: dvb-core: Fix receiving invalid EIT-sections	2020-01-08 11:46:34 +01:00
dvb_frontend.c	media: dvb-core: frontend: make GET/SET safer	2021-06-17 09:29:11 +02:00
dvb_math.c
dvb_net.c	media: dvb_net: avoid speculation from net slot	2021-06-17 09:25:01 +02:00
dvb_ringbuffer.c
dvb_vb2.c	media: media/v4l2: remove V4L2_FLAG_MEMORY_NON_CONSISTENT flag	2020-09-14 15:28:06 +02:00
dvbdev.c	media: dvbdev: fix error logic at dvb_register_device()	2021-06-17 09:25:31 +02:00
Kconfig	media: Kconfig: move DVB-specific options to dvb-core/Kconfig	2020-04-14 10:29:05 +02:00
Makefile