On Sat Jan 10 23:58:29 2026 +0900, Jeongjun Park wrote:
> In hackrf driver, the following race condition occurs:
> ```
> CPU0 CPU1
> hackrf_probe()
> kzalloc(); // alloc hackrf_dev
> ....
> v4l2_device_register();
> ....
> fd =
> sys_open("/path/to/dev"); // open hackrf fd
> ....
> v4l2_device_unregister();
> ....
> kfree(); // free hackrf_dev
> ....
> sys_ioctl(fd, ...);
> v4l2_ioctl();
> video_is_registered() //
> UAF!!
> ....
> sys_close(fd);
> v4l2_release() // UAF!!
> hackrf_video_release()
> kfree(); // DFB!!
> ```
>
> When a V4L2 or video device is unregistered, the device node is removed so
> new open() calls are blocked.
>
> However, file descriptors that are already open-and any in-flight I/O-do
> not terminate immediately; they remain valid until the last reference is
> dropped and the driver's release() is invoked.
>
> Therefore, freeing device memory on the error path after hackrf_probe()
> has registered dev it will lead to a race to use-after-free vuln, since
> those already-open handles haven't been released yet.
>
> And since release() free memory too, race to use-after-free and
> double-free vuln occur.
>
> To prevent this, if device is registered from probe(), it should be
> modified to free memory only through release() rather than calling
> kfree() directly.
>
> Cc: <[email protected]>
> Reported-by: [email protected]
> Closes: https://syzkaller.appspot.com/bug?extid=6ffd76b5405c006a46b7
> Reported-by: [email protected]
> Closes: https://syzkaller.appspot.com/bug?extid=f1b20958f93d2d250727
> Fixes: 8bc4a9ed8504 ("[media] hackrf: add support for transmitter")
> Signed-off-by: Jeongjun Park <[email protected]>
> Signed-off-by: Hans Verkuil <[email protected]>
Patch committed.
Thanks,
Hans Verkuil
drivers/media/usb/hackrf/hackrf.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
---
diff --git a/drivers/media/usb/hackrf/hackrf.c
b/drivers/media/usb/hackrf/hackrf.c
index 94d356fba612..a15829a60e88 100644
--- a/drivers/media/usb/hackrf/hackrf.c
+++ b/drivers/media/usb/hackrf/hackrf.c
@@ -1485,7 +1485,7 @@ static int hackrf_probe(struct usb_interface *intf,
if (ret) {
dev_err(dev->dev,
"Failed to register as video device (%d)\n", ret);
- goto err_v4l2_device_unregister;
+ goto err_v4l2_device_put;
}
dev_info(dev->dev, "Registered as %s\n",
video_device_node_name(&dev->rx_vdev));
@@ -1513,8 +1513,9 @@ static int hackrf_probe(struct usb_interface *intf,
return 0;
err_video_unregister_device_rx:
video_unregister_device(&dev->rx_vdev);
-err_v4l2_device_unregister:
- v4l2_device_unregister(&dev->v4l2_dev);
+err_v4l2_device_put:
+ v4l2_device_put(&dev->v4l2_dev);
+ return ret;
err_v4l2_ctrl_handler_free_tx:
v4l2_ctrl_handler_free(&dev->tx_ctrl_handler);
err_v4l2_ctrl_handler_free_rx:
_______________________________________________
linuxtv-commits mailing list -- [email protected]
To unsubscribe send an email to [email protected]
