Lin Ma
3a664569b7
media: dvbdev: fix refcnt bug
Previous commit initialize the dvbdev->ref before the template copy,
which will overwrite the reference and cause refcnt bug.
refcount_t: addition on 0; use-after-free.
WARNING: CPU: 0 PID: 1 at lib/refcount.c:25 refcount_warn_saturate+0x17c/0x1f0 lib/refcount.c:25
Modules linked in:
CPU: 0 PID: 1 Comm: swapper/0 Not tainted 6.1.0-rc6-next-20221128-syzkaller #0
...
RIP: 0010:refcount_warn_saturate+0x17c/0x1f0 lib/refcount.c:25
RSP: 0000:ffffc900000678d0 EFLAGS: 00010282
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: ffff88813ff58000 RSI: ffffffff81660e7c RDI: fffff5200000cf0c
RBP: ffff888022a45010 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000080000000 R11: 0000000000000000 R12: 0000000000000001
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000001
FS: 0000000000000000(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffff88823ffff000 CR3: 000000000c48e000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
__refcount_add include/linux/refcount.h:199 [inline]
__refcount_inc include/linux/refcount.h:250 [inline]
refcount_inc include/linux/refcount.h:267 [inline]
kref_get include/linux/kref.h:45 [inline]
dvb_device_get drivers/media/dvb-core/dvbdev.c:585 [inline]
dvb_register_device+0xe83/0x16e0 drivers/media/dvb-core/dvbdev.c:517
...
Just place the kref_init at correct position.
Reported-by: syzbot+fce48a3dd3368645bd6c@syzkaller.appspotmail.com
Fixes: 0fc044b2b5 ("media: dvbdev: adopts refcnt to avoid UAF")
Signed-off-by: Lin Ma <linma@zju.edu.cn>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
2022-12-06 07:17:00 +00:00
..
2022-11-06 13:09:52 -08:00
2022-10-10 09:10:28 -07:00
2022-10-31 20:28:05 +09:00
2022-10-28 16:48:29 -07:00
2022-10-12 10:23:24 -07:00
2022-11-05 09:02:28 -07:00
2022-11-02 14:15:42 -07:00
2022-10-08 08:56:37 -07:00
2022-10-29 00:24:03 +02:00
2022-10-27 17:23:29 -07:00
2022-10-10 10:16:00 -07:00
2022-10-23 20:39:26 -04:00
2022-10-25 15:09:23 +02:00
2022-10-09 13:24:01 -07:00
2022-10-10 13:04:25 -07:00
2022-11-04 16:03:43 -07:00
2022-10-14 18:41:41 -07:00
2022-09-26 03:59:43 +09:00
2022-10-11 17:42:58 -06:00
2022-10-06 17:22:11 -07:00
2022-10-13 11:07:13 -07:00
2022-10-08 08:56:37 -07:00
2022-11-04 14:37:25 -07:00
2022-10-08 08:56:37 -07:00
2022-09-28 21:10:57 +09:30
2022-10-20 13:47:54 +02:00
2022-11-04 09:30:18 +10:00
2022-10-21 17:41:57 -07:00
2022-09-20 17:29:29 +02:00
2022-10-10 13:59:01 -07:00
2022-11-04 16:47:01 -07:00
2022-10-25 19:08:07 +02:00
2022-11-01 13:46:30 +01:00
2022-10-12 23:45:29 +02:00
2022-09-21 20:33:49 +02:00
2022-10-17 08:51:26 +01:00
2022-10-28 12:59:40 -03:00
2022-10-11 10:53:25 -07:00
2022-09-20 15:57:00 +03:00
2022-10-21 10:49:35 +02:00
2022-10-08 08:56:37 -07:00
2022-10-12 10:23:24 -07:00
2022-11-02 12:34:48 +00:00
2022-10-24 11:32:10 +02:00
2022-10-09 14:05:15 -07:00
2022-10-05 21:51:58 -05:00
2022-10-18 17:17:48 -04:00
2022-12-06 07:17:00 +00:00
2022-10-23 12:04:56 -07:00
2022-10-25 19:12:10 +02:00
2022-10-26 11:48:03 +02:00
2022-10-18 11:20:12 +02:00
2022-11-02 20:30:51 -07:00
2022-10-30 21:43:26 +00:00
2022-10-14 18:41:41 -07:00
2022-10-29 18:06:52 -07:00
2022-09-24 14:56:37 +02:00
2022-10-10 13:13:51 -07:00
2022-10-27 09:12:05 +02:00
2022-10-17 12:11:09 -05:00
2022-09-27 08:12:16 +02:00
2022-10-14 12:38:03 -07:00
2022-10-27 14:38:04 +03:00
2022-10-18 10:42:10 +02:00
2022-10-30 09:44:06 -07:00
2022-10-10 18:11:11 +02:00
2022-10-07 11:48:30 -07:00
2022-10-10 09:10:28 -07:00
2022-10-10 08:37:24 +01:00
2022-10-07 11:32:10 -07:00
2022-10-07 11:24:20 -07:00
2022-10-05 09:20:44 -06:00
2022-10-08 10:06:48 -07:00
2022-09-21 11:21:33 -06:00
2022-10-18 22:36:54 +02:00
2022-10-26 14:47:31 +02:00
2022-10-29 18:12:45 -07:00
2022-09-24 14:53:06 +02:00
2022-10-29 16:26:32 +08:00
2022-10-07 16:13:55 -07:00
2022-10-26 17:38:46 -07:00
2022-09-30 14:33:23 +02:00
2022-09-19 15:08:38 +02:00
2022-11-25 08:35:26 +00:00
2022-10-21 01:10:34 +00:00
2022-10-10 17:53:04 -07:00
2022-10-15 19:33:57 +02:00
2022-10-11 17:42:58 -06:00
2022-10-21 08:10:46 +02:00
2022-10-22 03:29:32 +00:00
2022-10-30 11:31:14 -07:00
2022-10-10 14:02:53 -07:00
2022-10-12 14:46:48 -07:00
2022-10-10 14:02:53 -07:00
2022-10-30 11:31:14 -07:00
2022-10-08 08:56:37 -07:00
2022-10-13 09:33:03 -04:00
2022-10-08 08:56:37 -07:00
2022-11-01 12:21:53 -07:00
2022-10-21 14:43:09 -07:00