This is a note to let you know that I've just added the patch titled
media: dvb-core: Fix double free in dvb_register_device()
to the 4.14-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
media-dvb-core-fix-double-free-in-dvb_register_device.patch
and it can be found in the queue-4.14 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
>From 6b0d0477fce747d4137aa65856318b55fba72198 Mon Sep 17 00:00:00 2001
From: Keita Suzuki <keitasuzuki.park@xxxxxxxxxxxxxxxxxxxx>
Date: Tue, 26 Apr 2022 06:29:19 +0100
Subject: media: dvb-core: Fix double free in dvb_register_device()
From: Keita Suzuki <keitasuzuki.park@xxxxxxxxxxxxxxxxxxxx>
commit 6b0d0477fce747d4137aa65856318b55fba72198 upstream.
In function dvb_register_device() -> dvb_register_media_device() ->
dvb_create_media_entity(), dvb->entity is allocated and initialized. If
the initialization fails, it frees the dvb->entity, and return an error
code. The caller takes the error code and handles the error by calling
dvb_media_device_free(), which unregisters the entity and frees the
field again if it is not NULL. As dvb->entity may not NULLed in
dvb_create_media_entity() when the allocation of dvbdev->pad fails, a
double free may occur. This may also cause an Use After free in
media_device_unregister_entity().
Fix this by storing NULL to dvb->entity when it is freed.
Link: https://lore.kernel.org/linux-media/20220426052921.2088416-1-keitasuzuki.park@xxxxxxxxxxxxxxxxxxxx
Fixes: fcd5ce4b3936 ("media: dvb-core: fix a memory leak bug")
Cc: stable@xxxxxxxxxxxxxxx
Cc: Wenwen Wang <wenwen@xxxxxxxxxx>
Signed-off-by: Keita Suzuki <keitasuzuki.park@xxxxxxxxxxxxxxxxxxxx>
Signed-off-by: Mauro Carvalho Chehab <mchehab@xxxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
drivers/media/dvb-core/dvbdev.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/media/dvb-core/dvbdev.c
+++ b/drivers/media/dvb-core/dvbdev.c
@@ -322,6 +322,7 @@ static int dvb_create_media_entity(struc
GFP_KERNEL);
if (!dvbdev->pads) {
kfree(dvbdev->entity);
+ dvbdev->entity = NULL;
return -ENOMEM;
}
}
Patches currently in stable-queue which might be from keitasuzuki.park@xxxxxxxxxxxxxxxxxxxx are
queue-4.14/media-dvb-core-fix-double-free-in-dvb_register_device.patch
