ACK: [SRU][K][PATCH 1/1] media: dvb-core: Fix UAF due to refcount races at releasing

[Stefan Bader]

On 15.03.23 18:40, Magali Lemes wrote:
> From: Takashi Iwai <tiwai at suse.de>
> 
> The dvb-core tries to sync the releases of opened files at
> dvb_dmxdev_release() with two refcounts: dvbdev->users and
> dvr_dvbdev->users.  A problem is present in those two syncs: when yet
> another dvb_demux_open() is called during those sync waits,
> dvb_demux_open() continues to process even if the device is being
> closed.  This includes the increment of the former refcount, resulting
> in the leftover refcount after the sync of the latter refcount at
> dvb_dmxdev_release().  It ends up with use-after-free, since the
> function believes that all usages were gone and releases the
> resources.
> 
> This patch addresses the problem by adding the check of dmxdev->exit
> flag at dvb_demux_open(), just like dvb_dvr_open() already does.  With
> the exit flag check, the second call of dvb_demux_open() fails, hence
> the further corruption can be avoided.
> 
> Also for avoiding the races of the dmxdev->exit flag reference, this
> patch serializes the dmxdev->exit set up and the sync waits with the
> dmxdev->mutex lock at dvb_dmxdev_release().  Without the mutex lock,
> dvb_demux_open() (or dvb_dvr_open()) may run concurrently with
> dvb_dmxdev_release(), which allows to skip the exit flag check and
> continue the open process that is being closed.
> 
> CVE-2022-41218 is assigned to those bugs above.
> 
> Reported-by: Hyunwoo Kim <imv4bel at gmail.com>
> Cc: <stable at vger.kernel.org>
> Link: https://lore.kernel.org/20220908132754.30532-1-tiwai@suse.de
> Signed-off-by: Takashi Iwai <tiwai at suse.de>
> Signed-off-by: Hans Verkuil <hverkuil-cisco at xs4all.nl>
> 
> CVE-2022-41218
> (cherry picked from commit fd3d91ab1c6ab0628fe642dd570b56302c30a792)
> Signed-off-by: Magali Lemes <magali.lemes at canonical.com>
Acked-by: Stefan Bader <stefan.bader at canonical.com>
> ---
>   drivers/media/dvb-core/dmxdev.c | 8 ++++++++
>   1 file changed, 8 insertions(+)
> 
> diff --git a/drivers/media/dvb-core/dmxdev.c b/drivers/media/dvb-core/dmxdev.c
> index f6ee678107d3..9ce5f010de3f 100644
> --- a/drivers/media/dvb-core/dmxdev.c
> +++ b/drivers/media/dvb-core/dmxdev.c
> @@ -790,6 +790,11 @@ static int dvb_demux_open(struct inode *inode, struct file *file)
>   	if (mutex_lock_interruptible(&dmxdev->mutex))
>   		return -ERESTARTSYS;
>   
> +	if (dmxdev->exit) {
> +		mutex_unlock(&dmxdev->mutex);
> +		return -ENODEV;
> +	}
> +
>   	for (i = 0; i < dmxdev->filternum; i++)
>   		if (dmxdev->filter[i].state == DMXDEV_STATE_FREE)
>   			break;
> @@ -1448,7 +1453,10 @@ EXPORT_SYMBOL(dvb_dmxdev_init);
>   
>   void dvb_dmxdev_release(struct dmxdev *dmxdev)
>   {
> +	mutex_lock(&dmxdev->mutex);
>   	dmxdev->exit = 1;
> +	mutex_unlock(&dmxdev->mutex);
> +
>   	if (dmxdev->dvbdev->users > 1) {
>   		wait_event(dmxdev->dvbdev->wait_queue,
>   				dmxdev->dvbdev->users == 1);

-- 
- Stefan

-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_0xE8675DEECBEECEA3.asc
Type: application/pgp-keys
Size: 44613 bytes
Desc: OpenPGP public key
URL: <https://lists.ubuntu.com/archives/kernel-team/attachments/20230316/91249452/attachment-0001.key>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_signature
Type: application/pgp-signature
Size: 833 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/kernel-team/attachments/20230316/91249452/attachment-0001.sig>