Hi, On Wed, Nov 16, 2022 at 12:08:03PM +0100, Salvatore Bonaccorso wrote: > Hi, > > On Tue, Oct 11, 2022 at 09:06:33AM +0200, Takashi Iwai wrote: > > On Wed, 21 Sep 2022 09:34:30 +0200, > > Takashi Iwai wrote: > > > > > > On Thu, 08 Sep 2022 15:27:54 +0200, > > > Takashi Iwai wrote: > > > > > > > > The dvb-core tries to sync the releases of opened files at > > > > dvb_dmxdev_release() with two refcounts: dvbdev->users and > > > > dvr_dvbdev->users. A problem is present in those two syncs: when yet > > > > another dvb_demux_open() is called during those sync waits, > > > > dvb_demux_open() continues to process even if the device is being > > > > closed. This includes the increment of the former refcount, resulting > > > > in the leftover refcount after the sync of the latter refcount at > > > > dvb_dmxdev_release(). It ends up with use-after-free, since the > > > > function believes that all usages were gone and releases the > > > > resources. > > > > > > > > This patch addresses the problem by adding the check of dmxdev->exit > > > > flag at dvb_demux_open(), just like dvb_dvr_open() already does. With > > > > the exit flag check, the second call of dvb_demux_open() fails, hence > > > > the further corruption can be avoided. > > > > > > > > Also for avoiding the races of the dmxdev->exit flag reference, this > > > > patch serializes the dmxdev->exit set up and the sync waits with the > > > > dmxdev->mutex lock at dvb_dmxdev_release(). Without the mutex lock, > > > > dvb_demux_open() (or dvb_dvr_open()) may run concurrently with > > > > dvb_dmxdev_release(), which allows to skip the exit flag check and > > > > continue the open process that is being closed. > > > > > > > > Reported-by: Hyunwoo Kim <imv4bel@xxxxxxxxx> > > > > Cc: <stable@xxxxxxxxxxxxxxx> > > > > Signed-off-by: Takashi Iwai <tiwai@xxxxxxx> > > > > > > Any review on this? > > > > > > FWIW, now CVE-2022-41218 is assigned for those bugs as a security > > > issue. > > > > A gentle ping again. > > > > Or if any other fix for this security issue is already available, > > please let me know. > > is this correct, the fix is yet missing (or was it fixed by other > means?). This patch has been re-send and has been missing for a long time: https://lore.kernel.org/linux-media/20221031100245.23702-1-tiwai@xxxxxxx/ However, I noticed yesterday that the status of the re-send patch changed to 'accpet': https://patchwork.linuxtv.org/project/linux-media/patch/20221031100245.23702-1-tiwai@xxxxxxx/ But there was no other feedback. Regards, Hyunwoo Kim
