Deepanshu Kartikey
680daf40a8
media: rtl2832: fix use-after-free in rtl2832_remove()
...
cancel_delayed_work_sync() is called before i2c_mux_del_adapters()
in rtl2832_remove(). While the cancel waits for any running instance
of i2c_gate_work to finish, it does not prevent the timer from being
rescheduled by a concurrent thread.
During probe, the r820t_attach() call attempts I2C transfers through
the mux adapter. These transfers go through i2c_mux_master_xfer(),
which calls rtl2832_deselect() after the transfer completes,
rescheduling i2c_gate_work via schedule_delayed_work(). If this
transfer is still in flight when rtl2832_remove() runs,
rtl2832_deselect() can reschedule i2c_gate_work after it has been
cancelled, causing a use-after-free when kfree(dev) is called.
Fix this by calling i2c_mux_del_adapters() before
cancel_delayed_work_sync(). Once the mux adapter is unregistered, no
new I2C transfers can go through it, so rtl2832_deselect() can no
longer reschedule i2c_gate_work. The subsequent
cancel_delayed_work_sync() is then guaranteed to be final.
Fixes: cddcc40b1b ("[media] rtl2832: convert to use an explicit i2c mux core")
Cc: stable@vger.kernel.org
Reported-by: syzbot+019ced393ab913002b75@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=019ced393ab913002b75
Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com >
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org >
2026-05-06 09:05:56 +02:00
..
2026-02-21 17:09:51 -08:00
2026-02-21 17:09:51 -08:00
2026-02-21 17:09:51 -08:00
2022-11-25 09:55:55 +00:00
2023-07-09 22:47:48 +01:00
2026-02-21 17:09:51 -08:00
2019-05-30 11:26:37 -07:00
2023-07-09 22:47:48 +01:00
2026-02-21 17:09:51 -08:00
2019-05-30 11:26:37 -07:00
2024-04-15 13:42:38 +02:00
2026-02-21 17:09:51 -08:00
2019-05-24 17:39:02 +02:00
2026-02-21 17:09:51 -08:00
2020-11-16 10:31:16 +01:00
2019-05-30 11:26:37 -07:00
2026-02-21 17:09:51 -08:00
2019-05-30 11:26:37 -07:00
2019-05-24 17:36:45 +02:00
2026-03-17 10:50:19 +01:00
2023-09-09 08:15:11 +01:00
2019-05-24 17:36:45 +02:00
2019-05-24 17:36:45 +02:00
2024-02-16 11:46:32 +01:00
2026-02-21 17:09:51 -08:00
2019-05-30 11:25:13 -07:00
2019-05-24 17:39:01 +02:00
2019-05-24 17:39:01 +02:00
2019-05-24 17:39:01 +02:00
2026-02-21 17:09:51 -08:00
2019-05-24 17:36:45 +02:00
2026-02-21 17:09:51 -08:00
2019-05-24 17:36:45 +02:00
2026-02-21 17:09:51 -08:00
2024-02-16 11:46:31 +01:00
2026-02-21 17:09:51 -08:00
2019-05-30 11:26:37 -07:00
2026-02-21 17:09:51 -08:00
2019-05-24 17:36:45 +02:00
2026-02-21 17:09:51 -08:00
2019-05-24 17:36:45 +02:00
2026-02-21 17:09:51 -08:00
2019-05-30 11:26:37 -07:00
2026-02-21 17:09:51 -08:00
2019-05-24 17:36:45 +02:00
2026-02-21 17:09:51 -08:00
2021-09-30 10:08:02 +02:00
2019-10-07 07:43:14 -03:00
2026-02-21 17:09:51 -08:00
2023-07-09 22:47:48 +01:00
2019-10-07 07:43:14 -03:00
2019-10-07 07:43:14 -03:00
2020-11-16 10:31:16 +01:00
2019-05-30 11:26:37 -07:00
2026-02-21 17:09:51 -08:00
2019-05-30 11:26:37 -07:00
2026-02-21 20:03:00 -08:00
2019-06-05 17:37:10 +02:00
2026-02-21 20:03:00 -08:00
2019-06-05 17:37:10 +02:00
2020-04-14 10:36:18 +02:00
2019-06-05 17:37:10 +02:00
2026-02-21 17:09:51 -08:00
2026-02-21 17:09:51 -08:00
2019-06-05 17:37:10 +02:00
2026-02-21 17:09:51 -08:00
2017-11-02 11:10:55 +01:00
2026-02-21 17:09:51 -08:00
2017-11-02 11:10:55 +01:00
2026-03-16 16:30:20 +01:00
2017-11-02 11:10:55 +01:00
2026-02-21 17:09:51 -08:00
2017-11-02 11:10:55 +01:00
2025-02-21 10:33:10 +01:00
2018-03-06 04:08:17 -05:00
2019-06-19 17:09:09 +02:00
2019-06-19 17:09:09 +02:00
2026-02-21 17:09:51 -08:00
2019-06-19 17:09:09 +02:00
2019-06-19 17:09:09 +02:00
2026-02-21 17:09:51 -08:00
2017-11-02 11:10:55 +01:00
2017-11-02 11:10:55 +01:00
2020-11-16 10:31:16 +01:00
2026-02-21 17:09:51 -08:00
2019-05-24 17:36:45 +02:00
2026-02-21 17:09:51 -08:00
2020-01-08 11:44:21 +01:00
2026-02-21 17:09:51 -08:00
2020-11-16 10:31:16 +01:00
2026-02-21 17:09:51 -08:00
2019-05-30 11:26:37 -07:00
2020-04-14 10:36:18 +02:00
2026-02-21 17:09:51 -08:00
2019-05-24 17:39:02 +02:00
2026-02-21 17:09:51 -08:00
2020-11-16 10:31:16 +01:00
2026-02-21 17:09:51 -08:00
2020-11-16 10:31:16 +01:00
2026-02-21 17:09:51 -08:00
2019-05-24 17:39:01 +02:00
2026-02-21 17:09:51 -08:00
2019-05-24 17:39:01 +02:00
2026-02-21 17:09:51 -08:00
2019-05-24 17:36:45 +02:00
2019-05-30 11:26:37 -07:00
2026-02-21 17:09:51 -08:00
2019-05-30 11:26:37 -07:00
2026-02-21 17:09:51 -08:00
2020-11-16 10:31:16 +01:00
2025-08-29 11:04:02 +02:00
2026-02-21 17:09:51 -08:00
2019-05-24 17:36:45 +02:00
2026-02-21 17:09:51 -08:00
2019-05-30 11:26:37 -07:00
2019-05-30 11:26:37 -07:00
2026-02-21 17:09:51 -08:00
2019-05-30 11:26:37 -07:00
2026-02-21 17:09:51 -08:00
2019-05-30 11:26:37 -07:00
2026-02-21 17:09:51 -08:00
2019-05-30 11:26:37 -07:00
2026-02-21 17:09:51 -08:00
2019-05-24 17:36:45 +02:00
2019-05-30 11:26:37 -07:00
2026-02-21 17:09:51 -08:00
2019-05-30 11:26:37 -07:00
2019-05-30 11:26:37 -07:00
2026-02-21 17:09:51 -08:00
2019-05-30 11:26:37 -07:00
2026-02-21 17:09:51 -08:00
2018-09-12 09:24:41 -04:00
2026-02-21 17:09:51 -08:00
2019-05-24 17:39:01 +02:00
2026-02-21 17:09:51 -08:00
2019-05-24 17:39:01 +02:00
2026-03-25 18:27:25 +01:00
2026-03-25 18:27:25 +01:00
2020-11-16 10:31:16 +01:00
2026-02-21 17:09:51 -08:00
2019-05-24 17:36:45 +02:00
2022-03-14 09:42:59 +01:00
2019-05-24 17:36:45 +02:00
2026-02-21 17:09:51 -08:00
2019-05-24 17:36:45 +02:00
2026-02-21 17:09:51 -08:00
2020-11-16 10:31:16 +01:00
2025-10-17 11:31:15 +02:00
2018-08-02 18:54:03 -04:00
2023-07-09 22:47:48 +01:00
2026-02-21 17:09:51 -08:00
2019-05-30 11:26:37 -07:00
2023-07-09 22:47:48 +01:00
2026-02-21 17:09:51 -08:00
2019-05-30 11:26:37 -07:00
2019-05-24 17:36:45 +02:00
2026-02-21 17:09:51 -08:00
2019-05-24 17:36:45 +02:00
2019-05-30 11:26:37 -07:00
2026-02-21 17:09:51 -08:00
2019-05-30 11:26:37 -07:00
2024-06-15 10:49:21 +02:00
2021-09-30 10:08:01 +02:00
2026-02-21 17:09:51 -08:00
2021-09-30 10:08:01 +02:00
2021-09-30 10:08:01 +02:00
2026-02-21 17:09:51 -08:00
2021-09-30 10:08:01 +02:00
2026-02-21 17:09:51 -08:00
2019-05-30 11:26:37 -07:00
2017-11-02 11:10:55 +01:00
2026-02-21 17:09:51 -08:00
2019-05-24 17:36:45 +02:00
2026-02-21 17:09:51 -08:00
2019-05-30 11:26:37 -07:00
2026-02-21 17:09:51 -08:00
2019-05-30 11:26:37 -07:00
2023-07-09 22:47:48 +01:00
2026-02-21 17:09:51 -08:00
2019-05-30 11:26:37 -07:00
2023-07-09 22:47:48 +01:00
2026-02-21 17:09:51 -08:00
2019-05-21 11:28:39 +02:00
2026-05-06 09:05:56 +02:00
2019-05-21 11:28:39 +02:00
2026-02-21 17:09:51 -08:00
2019-05-24 17:36:45 +02:00
2026-02-21 17:09:51 -08:00
2019-05-24 17:36:45 +02:00
2019-05-24 17:36:45 +02:00
2026-02-21 20:03:00 -08:00
2019-05-30 11:26:37 -07:00
2026-02-21 17:09:51 -08:00
2019-05-30 11:26:37 -07:00
2026-02-21 17:09:51 -08:00
2019-06-05 17:36:37 +02:00
2026-02-21 17:09:51 -08:00
2017-12-28 13:16:01 -05:00
2019-05-30 11:26:37 -07:00
2026-02-21 17:09:51 -08:00
2020-11-27 13:05:07 +01:00
2021-11-19 16:38:38 +00:00
2026-03-17 10:50:19 +01:00
2019-10-10 07:05:51 -03:00
2019-05-30 11:26:37 -07:00
2026-02-21 17:09:51 -08:00
2019-05-30 11:26:37 -07:00
2026-02-21 17:09:51 -08:00
2017-11-02 11:10:55 +01:00
2024-10-18 10:43:03 +02:00
2019-05-24 17:36:45 +02:00
2026-02-21 17:09:51 -08:00
2019-05-24 17:36:45 +02:00
2019-05-24 17:36:45 +02:00
2019-05-24 17:36:45 +02:00
2026-02-21 17:09:51 -08:00
2020-11-16 10:31:16 +01:00
2019-05-24 17:36:45 +02:00
2019-05-24 17:36:45 +02:00
2026-02-21 17:09:51 -08:00
2019-05-24 17:36:45 +02:00
2019-06-10 15:01:38 -04:00
2019-05-24 17:36:45 +02:00
2026-02-21 17:09:51 -08:00
2019-06-10 15:01:38 -04:00
2026-02-21 17:09:51 -08:00
2019-05-24 17:36:45 +02:00
2026-02-21 17:09:51 -08:00
2019-05-24 17:36:45 +02:00
2026-02-21 17:09:51 -08:00
2019-05-24 17:36:45 +02:00
2019-05-30 11:26:37 -07:00
2024-07-28 15:49:18 -07:00
2019-05-30 11:26:37 -07:00
2026-02-21 17:09:51 -08:00
2019-05-30 11:26:37 -07:00
2026-02-21 20:03:00 -08:00
2019-05-30 11:26:37 -07:00
2019-05-30 11:26:37 -07:00
2019-05-30 11:26:37 -07:00
2019-05-30 11:26:37 -07:00
2019-05-30 11:26:37 -07:00
2018-09-12 07:19:58 -04:00
2026-02-21 17:09:51 -08:00
2021-09-30 10:08:02 +02:00
2026-02-21 17:09:51 -08:00
2019-05-30 11:26:37 -07:00
2024-02-16 11:46:32 +01:00
2019-05-24 17:36:45 +02:00
2026-02-21 17:09:51 -08:00
2019-06-10 14:59:04 -04:00
2026-02-21 17:09:51 -08:00
2021-09-30 10:08:01 +02:00
2026-02-21 17:09:51 -08:00
2019-10-07 07:50:41 -03:00
2026-02-21 17:09:51 -08:00
2019-05-24 17:36:45 +02:00
2026-02-21 17:09:51 -08:00
2020-11-16 10:31:16 +01:00
2022-08-29 15:32:13 +02:00
2026-02-21 17:09:51 -08:00
2019-05-24 17:36:45 +02:00
2026-02-21 17:09:51 -08:00
2024-02-16 11:46:32 +01:00
2019-05-24 17:36:45 +02:00
2026-02-21 17:09:51 -08:00
2019-05-24 17:36:45 +02:00
2026-02-21 17:09:51 -08:00
2026-02-21 17:09:51 -08:00
2026-02-21 17:09:51 -08:00
2019-05-24 17:36:45 +02:00
2019-05-21 11:28:39 +02:00
2026-02-21 17:09:51 -08:00
2019-05-21 11:28:39 +02:00
2026-02-21 17:09:51 -08:00
2019-05-24 17:36:45 +02:00
2020-09-27 11:26:00 +02:00
2026-02-21 17:09:51 -08:00
2018-01-04 13:12:01 -05:00
2019-05-24 17:39:01 +02:00
2026-02-21 17:09:51 -08:00
2019-05-24 17:36:45 +02:00
2026-02-21 17:09:51 -08:00
2019-05-30 11:26:37 -07:00
2026-02-21 17:09:51 -08:00
2019-05-24 17:36:45 +02:00
2026-02-21 17:09:51 -08:00
2019-05-24 17:36:45 +02:00
2020-04-14 10:36:18 +02:00
2026-02-21 17:09:51 -08:00
2020-09-30 18:50:20 +02:00
2026-02-21 17:09:51 -08:00
2024-02-16 11:46:31 +01:00
2026-02-21 17:09:51 -08:00
2019-05-24 17:36:45 +02:00
2019-05-30 11:26:37 -07:00
2026-02-21 17:09:51 -08:00
2019-05-30 11:26:37 -07:00