On 18/07/2023 05:07, Zheng Hacker wrote:
Friendly ping
Zheng Hacker <hackerzheng666@xxxxxxxxx> 于2023年7月16日周日 00:08写道：
Hi,
This issue has not been resolved for a long time. Is there anyone who can help?
Best regards,
Zheng
Alexandre Mergnat <amergnat@xxxxxxxxxxxx> 于2023年7月7日周五 22:11写道：
On 07/07/2023 11:24, Zheng Wang wrote:
In mtk_jpeg_probe, &jpeg->job_timeout_work is bound with
mtk_jpeg_job_timeout_work. Then mtk_jpeg_dec_device_run
and mtk_jpeg_enc_device_run may be called to start the
work.
If we remove the module which will call mtk_jpeg_remove
to make cleanup, there may be a unfinished work. The
possible sequence is as follows, which will cause a
typical UAF bug.
Fix it by canceling the work before cleanup in the mtk_jpeg_remove
CPU0 CPU1
|mtk_jpeg_job_timeout_work
mtk_jpeg_remove |
v4l2_m2m_release |
kfree(m2m_dev); |
|
| v4l2_m2m_get_curr_priv
| m2m_dev->curr_ctx //use
Reviewed-by: Alexandre Mergnat <amergnat@xxxxxxxxxxxx>
--
Regards,
Alexandre
Hi Zheng,
If you asking me to merge patch, sorry but I can't, I'm just a reviewer.
I invite you to ping the maintainers directly:
Bin Liu <bin.liu@xxxxxxxxxxxx> (supporter:MEDIATEK JPEG DRIVER)
Mauro Carvalho Chehab <mchehab@xxxxxxxxxx> (maintainer:MEDIA INPUT
INFRASTRUCTURE (V4L/DVB))
Matthias Brugger <matthias.bgg@xxxxxxxxx> (maintainer:ARM/Mediatek SoC
support)
Otherwise, I misunderstood what you asking me. If so, can you rephrase
your question please?
--
Regards,
Alexandre
