diff options
| author | sumitg <[email protected]> | 2019-05-17 13:53:42 +0000 |
|---|---|---|
| committer | Mauro Carvalho Chehab <[email protected]> | 2019-05-28 16:50:33 +0000 |
| commit | 3e0f724346e96daae7792262c6767449795ac3b5 (patch) | |
| tree | 128521a788727c8e4382a361e974a52dd74abca9 /drivers/media/platform/vimc/vimc-core.c | |
| parent | media: rcar-csi2: Fix coccinelle warning for PTR_ERR_OR_ZERO() (diff) | |
| download | kernel-3e0f724346e96daae7792262c6767449795ac3b5.tar.gz kernel-3e0f724346e96daae7792262c6767449795ac3b5.zip | |
media: v4l2-core: fix use-after-free error
Fixing use-after-free within __v4l2_ctrl_handler_setup().
Memory is being freed with kfree(new_ref) for duplicate
control reference entry but ctrl->cluster pointer is still
referring to freed duplicate entry resulting in error on
access. Change done to update cluster pointer only when new
control reference is added.
==================================================================
BUG: KASAN: use-after-free in __v4l2_ctrl_handler_setup+0x388/0x428
Read of size 8 at addr ffffffc324e78618 by task systemd-udevd/312
Allocated by task 312:
Freed by task 312:
The buggy address belongs to the object at ffffffc324e78600
which belongs to the cache kmalloc-64 of size 64
The buggy address is located 24 bytes inside of
64-byte region [ffffffc324e78600, ffffffc324e78640)
The buggy address belongs to the page:
page:ffffffbf0c939e00 count:1 mapcount:0 mapping:
(null) index:0xffffffc324e78f80
flags: 0x4000000000000100(slab)
raw: 4000000000000100 0000000000000000 ffffffc324e78f80 000000018020001a
raw: 0000000000000000 0000000100000001 ffffffc37040fb80 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffffffc324e78500: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
ffffffc324e78580: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
>ffffffc324e78600: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
^
ffffffc324e78680: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc
ffffffc324e78700: 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc
==================================================================
Suggested-by: Hans Verkuil <[email protected]>
Signed-off-by: Sumit Gupta <[email protected]>
Signed-off-by: Hans Verkuil <[email protected]>
Signed-off-by: Mauro Carvalho Chehab <[email protected]>
Diffstat (limited to 'drivers/media/platform/vimc/vimc-core.c')
0 files changed, 0 insertions, 0 deletions