In the Linux kernel, the following vulnerability has been resolved: media: xc2028: avoid use-after-free in loadfirmwarecb() syzkaller reported use-after-free in loadfirmwarecb() [1]. The reason is because the module allocated a struct tuner in tunerprobe(), and then the module initialization failed, the struct tuner was released. A worker which created during module initialization accesses this struct tuner later, it caused use-after-free. The process is as follows: task-6504 workerthread tunerprobe <= alloc dvbfrontend [2] ... requestfirmwarenowait <= create a worker ... tunerremove <= free dvbfrontend ... requestfirmwareworkfunc <= the firmware is ready loadfirmwarecb <= but now the dvbfrontend has been freed To fix the issue, check the dvdfrontend in loadfirmwarecb(), if it is null, report a warning and just return. [1]: ================================================================== BUG: KASAN: use-after-free in loadfirmwarecb+0x1310/0x17a0 Read of size 8 at addr ffff8000d7ca2308 by task kworker/2:3/6504 Call trace: loadfirmwarecb+0x1310/0x17a0 requestfirmwareworkfunc+0x128/0x220 processonework+0x770/0x1824 workerthread+0x488/0xea0 kthread+0x300/0x430 retfromfork+0x10/0x20 Allocated by task 6504: kzalloc tunerprobe+0xb0/0x1430 i2cdeviceprobe+0x92c/0xaf0 reallyprobe+0x678/0xcd0 driverprobedevice+0x280/0x370 _deviceattachdriver+0x220/0x330 busforeachdrv+0x134/0x1c0 _deviceattach+0x1f4/0x410 deviceinitialprobe+0x20/0x30 busprobedevice+0x184/0x200 deviceadd+0x924/0x12c0 deviceregister+0x24/0x30 i2cnewdevice+0x4e0/0xc44 v4l2i2cnewsubdevboard+0xbc/0x290 v4l2i2cnewsubdev+0xc8/0x104 em28xxv4l2init+0x1dd0/0x3770 Freed by task 6504: kfree+0x238/0x4e4 tunerremove+0x144/0x1c0 i2cdeviceremove+0xc8/0x290 _devicereleasedriver+0x314/0x5fc devicereleasedriver+0x30/0x44 busremovedevice+0x244/0x490 devicedel+0x350/0x900 deviceunregister+0x28/0xd0 i2cunregisterdevice+0x174/0x1d0 v4l2deviceunregister+0x224/0x380 em28xxv4l2init+0x1d90/0x3770 The buggy address belongs to the object at ffff8000d7ca2000 which belongs to the cache kmalloc-2k of size 2048 The buggy address is located 776 bytes inside of 2048-byte region [ffff8000d7ca2000, ffff8000d7ca2800) The buggy address belongs to the page: page:ffff7fe00035f280 count:1 mapcount:0 mapping:ffff8000c001f000 index:0x0 flags: 0x7ff800000000100(slab) raw: 07ff800000000100 ffff7fe00049d880 0000000300000003 ffff8000c001f000 raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff8000d7ca2200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff8000d7ca2280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff8000d7ca2300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff8000d7ca2380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff8000d7ca2400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ================================================================== [2] Actually, it is allocated for struct tuner, and dvb_frontend is inside.
{ "availability": "No subscription required", "ubuntu_priority": "medium", "binaries": [ { "binary_version": "6.11.0-7.7", "binary_name": "linux-bpf-dev" }, { "binary_version": "6.11.0-7.7", "binary_name": "linux-buildinfo-6.11.0-7-generic" }, { "binary_version": "6.11.0-7.7", "binary_name": "linux-buildinfo-6.11.0-7-generic-64k" }, { "binary_version": "6.11.0-7.7", "binary_name": "linux-cloud-tools-6.11.0-7" }, { "binary_version": "6.11.0-7.7", "binary_name": "linux-cloud-tools-6.11.0-7-generic" }, { "binary_version": "6.11.0-7.7", "binary_name": "linux-cloud-tools-common" }, { "binary_version": "6.11.0-7.7", "binary_name": "linux-doc" }, { "binary_version": "6.11.0-7.7", "binary_name": "linux-headers-6.11.0-7" }, { "binary_version": "6.11.0-7.7", "binary_name": "linux-headers-6.11.0-7-generic" }, { "binary_version": "6.11.0-7.7", "binary_name": "linux-headers-6.11.0-7-generic-64k" }, { "binary_version": "6.11.0-7.7", "binary_name": "linux-image-6.11.0-7-generic" }, { "binary_version": "6.11.0-7.7", "binary_name": "linux-image-6.11.0-7-generic-dbgsym" }, { "binary_version": "6.11.0-7.7", "binary_name": "linux-image-unsigned-6.11.0-7-generic" }, { "binary_version": "6.11.0-7.7", "binary_name": "linux-image-unsigned-6.11.0-7-generic-64k" }, { "binary_version": "6.11.0-7.7", "binary_name": "linux-image-unsigned-6.11.0-7-generic-64k-dbgsym" }, { "binary_version": "6.11.0-7.7", "binary_name": "linux-image-unsigned-6.11.0-7-generic-dbgsym" }, { "binary_version": "6.11.0-7.7", "binary_name": "linux-lib-rust-6.11.0-7-generic" }, { "binary_version": "6.11.0-7.7", "binary_name": "linux-libc-dev" }, { "binary_version": "6.11.0-7.7", "binary_name": "linux-modules-6.11.0-7-generic" }, { "binary_version": "6.11.0-7.7", "binary_name": "linux-modules-6.11.0-7-generic-64k" }, { "binary_version": "6.11.0-7.7", "binary_name": "linux-modules-extra-6.11.0-7-generic" }, { "binary_version": "6.11.0-7.7", "binary_name": "linux-modules-ipu6-6.11.0-7-generic" }, { "binary_version": "6.11.0-7.7", "binary_name": "linux-modules-ipu7-6.11.0-7-generic" }, { "binary_version": "6.11.0-7.7", "binary_name": "linux-modules-iwlwifi-6.11.0-7-generic" }, { "binary_version": "6.11.0-7.7", "binary_name": "linux-modules-usbio-6.11.0-7-generic" }, { "binary_version": "6.11.0-7.7", "binary_name": "linux-modules-vision-6.11.0-7-generic" }, { "binary_version": "6.11.0-7.7", "binary_name": "linux-source-6.11.0" }, { "binary_version": "6.11.0-7.7", "binary_name": "linux-tools-6.11.0-7" }, { "binary_version": "6.11.0-7.7", "binary_name": "linux-tools-6.11.0-7-generic" }, { "binary_version": "6.11.0-7.7", "binary_name": "linux-tools-6.11.0-7-generic-64k" }, { "binary_version": "6.11.0-7.7", "binary_name": "linux-tools-common" }, { "binary_version": "6.11.0-7.7", "binary_name": "linux-tools-host" } ] }
{ "availability": "No subscription required", "ubuntu_priority": "medium", "binaries": [ { "binary_version": "6.11.0-1002.2", "binary_name": "linux-aws-cloud-tools-6.11.0-1002" }, { "binary_version": "6.11.0-1002.2", "binary_name": "linux-aws-headers-6.11.0-1002" }, { "binary_version": "6.11.0-1002.2", "binary_name": "linux-aws-tools-6.11.0-1002" }, { "binary_version": "6.11.0-1002.2", "binary_name": "linux-buildinfo-6.11.0-1002-aws" }, { "binary_version": "6.11.0-1002.2", "binary_name": "linux-cloud-tools-6.11.0-1002-aws" }, { "binary_version": "6.11.0-1002.2", "binary_name": "linux-headers-6.11.0-1002-aws" }, { "binary_version": "6.11.0-1002.2", "binary_name": "linux-image-unsigned-6.11.0-1002-aws" }, { "binary_version": "6.11.0-1002.2", "binary_name": "linux-image-unsigned-6.11.0-1002-aws-dbgsym" }, { "binary_version": "6.11.0-1002.2", "binary_name": "linux-modules-6.11.0-1002-aws" }, { "binary_version": "6.11.0-1002.2", "binary_name": "linux-modules-extra-6.11.0-1002-aws" }, { "binary_version": "6.11.0-1002.2", "binary_name": "linux-tools-6.11.0-1002-aws" } ] }
{ "availability": "No subscription required", "ubuntu_priority": "medium", "binaries": [ { "binary_version": "6.11.0-1003.3", "binary_name": "linux-azure-cloud-tools-6.11.0-1003" }, { "binary_version": "6.11.0-1003.3", "binary_name": "linux-azure-headers-6.11.0-1003" }, { "binary_version": "6.11.0-1003.3", "binary_name": "linux-azure-tools-6.11.0-1003" }, { "binary_version": "6.11.0-1003.3", "binary_name": "linux-buildinfo-6.11.0-1003-azure" }, { "binary_version": "6.11.0-1003.3", "binary_name": "linux-cloud-tools-6.11.0-1003-azure" }, { "binary_version": "6.11.0-1003.3", "binary_name": "linux-headers-6.11.0-1003-azure" }, { "binary_version": "6.11.0-1003.3", "binary_name": "linux-image-unsigned-6.11.0-1003-azure" }, { "binary_version": "6.11.0-1003.3", "binary_name": "linux-image-unsigned-6.11.0-1003-azure-dbgsym" }, { "binary_version": "6.11.0-1003.3", "binary_name": "linux-modules-6.11.0-1003-azure" }, { "binary_version": "6.11.0-1003.3", "binary_name": "linux-modules-extra-6.11.0-1003-azure" }, { "binary_version": "6.11.0-1003.3", "binary_name": "linux-modules-iwlwifi-6.11.0-1003-azure" }, { "binary_version": "6.11.0-1003.3", "binary_name": "linux-tools-6.11.0-1003-azure" } ] }
{ "availability": "No subscription required", "ubuntu_priority": "medium", "binaries": [ { "binary_version": "6.11.0-1001.1", "binary_name": "linux-buildinfo-6.11.0-1001-gcp" }, { "binary_version": "6.11.0-1001.1", "binary_name": "linux-gcp-headers-6.11.0-1001" }, { "binary_version": "6.11.0-1001.1", "binary_name": "linux-gcp-tools-6.11.0-1001" }, { "binary_version": "6.11.0-1001.1", "binary_name": "linux-headers-6.11.0-1001-gcp" }, { "binary_version": "6.11.0-1001.1", "binary_name": "linux-image-unsigned-6.11.0-1001-gcp" }, { "binary_version": "6.11.0-1001.1", "binary_name": "linux-image-unsigned-6.11.0-1001-gcp-dbgsym" }, { "binary_version": "6.11.0-1001.1", "binary_name": "linux-modules-6.11.0-1001-gcp" }, { "binary_version": "6.11.0-1001.1", "binary_name": "linux-modules-extra-6.11.0-1001-gcp" }, { "binary_version": "6.11.0-1001.1", "binary_name": "linux-tools-6.11.0-1001-gcp" } ] }
{ "availability": "No subscription required", "ubuntu_priority": "medium", "binaries": [ { "binary_version": "6.11.0-1002.2", "binary_name": "linux-buildinfo-6.11.0-1002-lowlatency" }, { "binary_version": "6.11.0-1002.2", "binary_name": "linux-buildinfo-6.11.0-1002-lowlatency-64k" }, { "binary_version": "6.11.0-1002.2", "binary_name": "linux-cloud-tools-6.11.0-1002-lowlatency" }, { "binary_version": "6.11.0-1002.2", "binary_name": "linux-headers-6.11.0-1002-lowlatency" }, { "binary_version": "6.11.0-1002.2", "binary_name": "linux-headers-6.11.0-1002-lowlatency-64k" }, { "binary_version": "6.11.0-1002.2", "binary_name": "linux-image-unsigned-6.11.0-1002-lowlatency" }, { "binary_version": "6.11.0-1002.2", "binary_name": "linux-image-unsigned-6.11.0-1002-lowlatency-64k" }, { "binary_version": "6.11.0-1002.2", "binary_name": "linux-image-unsigned-6.11.0-1002-lowlatency-64k-dbgsym" }, { "binary_version": "6.11.0-1002.2", "binary_name": "linux-image-unsigned-6.11.0-1002-lowlatency-dbgsym" }, { "binary_version": "6.11.0-1002.2", "binary_name": "linux-lowlatency-cloud-tools-6.11.0-1002" }, { "binary_version": "6.11.0-1002.2", "binary_name": "linux-lowlatency-cloud-tools-common" }, { "binary_version": "6.11.0-1002.2", "binary_name": "linux-lowlatency-headers-6.11.0-1002" }, { "binary_version": "6.11.0-1002.2", "binary_name": "linux-lowlatency-lib-rust-6.11.0-1002-lowlatency" }, { "binary_version": "6.11.0-1002.2", "binary_name": "linux-lowlatency-tools-6.11.0-1002" }, { "binary_version": "6.11.0-1002.2", "binary_name": "linux-lowlatency-tools-common" }, { "binary_version": "6.11.0-1002.2", "binary_name": "linux-lowlatency-tools-host" }, { "binary_version": "6.11.0-1002.2", "binary_name": "linux-modules-6.11.0-1002-lowlatency" }, { "binary_version": "6.11.0-1002.2", "binary_name": "linux-modules-6.11.0-1002-lowlatency-64k" }, { "binary_version": "6.11.0-1002.2", "binary_name": "linux-modules-iwlwifi-6.11.0-1002-lowlatency" }, { "binary_version": "6.11.0-1002.2", "binary_name": "linux-tools-6.11.0-1002-lowlatency" }, { "binary_version": "6.11.0-1002.2", "binary_name": "linux-tools-6.11.0-1002-lowlatency-64k" } ] }
{ "availability": "No subscription required", "ubuntu_priority": "medium", "binaries": [ { "binary_version": "6.11.0-1004.4", "binary_name": "linux-buildinfo-6.11.0-1004-oracle" }, { "binary_version": "6.11.0-1004.4", "binary_name": "linux-buildinfo-6.11.0-1004-oracle-64k" }, { "binary_version": "6.11.0-1004.4", "binary_name": "linux-headers-6.11.0-1004-oracle" }, { "binary_version": "6.11.0-1004.4", "binary_name": "linux-headers-6.11.0-1004-oracle-64k" }, { "binary_version": "6.11.0-1004.4", "binary_name": "linux-image-unsigned-6.11.0-1004-oracle" }, { "binary_version": "6.11.0-1004.4", "binary_name": "linux-image-unsigned-6.11.0-1004-oracle-64k" }, { "binary_version": "6.11.0-1004.4", "binary_name": "linux-image-unsigned-6.11.0-1004-oracle-64k-dbgsym" }, { "binary_version": "6.11.0-1004.4", "binary_name": "linux-image-unsigned-6.11.0-1004-oracle-dbgsym" }, { "binary_version": "6.11.0-1004.4", "binary_name": "linux-modules-6.11.0-1004-oracle" }, { "binary_version": "6.11.0-1004.4", "binary_name": "linux-modules-6.11.0-1004-oracle-64k" }, { "binary_version": "6.11.0-1004.4", "binary_name": "linux-modules-extra-6.11.0-1004-oracle" }, { "binary_version": "6.11.0-1004.4", "binary_name": "linux-modules-extra-6.11.0-1004-oracle-64k" }, { "binary_version": "6.11.0-1004.4", "binary_name": "linux-oracle-headers-6.11.0-1004" }, { "binary_version": "6.11.0-1004.4", "binary_name": "linux-oracle-tools-6.11.0-1004" }, { "binary_version": "6.11.0-1004.4", "binary_name": "linux-tools-6.11.0-1004-oracle" }, { "binary_version": "6.11.0-1004.4", "binary_name": "linux-tools-6.11.0-1004-oracle-64k" } ] }
{ "availability": "No subscription required", "ubuntu_priority": "medium", "binaries": [ { "binary_version": "6.11.0-1003.3", "binary_name": "linux-buildinfo-6.11.0-1003-raspi" }, { "binary_version": "6.11.0-1003.3", "binary_name": "linux-headers-6.11.0-1003-raspi" }, { "binary_version": "6.11.0-1003.3", "binary_name": "linux-image-6.11.0-1003-raspi" }, { "binary_version": "6.11.0-1003.3", "binary_name": "linux-image-6.11.0-1003-raspi-dbgsym" }, { "binary_version": "6.11.0-1003.3", "binary_name": "linux-modules-6.11.0-1003-raspi" }, { "binary_version": "6.11.0-1003.3", "binary_name": "linux-raspi-headers-6.11.0-1003" }, { "binary_version": "6.11.0-1003.3", "binary_name": "linux-raspi-tools-6.11.0-1003" }, { "binary_version": "6.11.0-1003.3", "binary_name": "linux-tools-6.11.0-1003-raspi" } ] }
{ "availability": "No subscription required", "ubuntu_priority": "medium", "binaries": [ { "binary_version": "6.11.0-1001.1", "binary_name": "linux-buildinfo-6.11.0-1001-realtime" }, { "binary_version": "6.11.0-1001.1", "binary_name": "linux-cloud-tools-6.11.0-1001-realtime" }, { "binary_version": "6.11.0-1001.1", "binary_name": "linux-headers-6.11.0-1001-realtime" }, { "binary_version": "6.11.0-1001.1", "binary_name": "linux-image-unsigned-6.11.0-1001-realtime" }, { "binary_version": "6.11.0-1001.1", "binary_name": "linux-image-unsigned-6.11.0-1001-realtime-dbgsym" }, { "binary_version": "6.11.0-1001.1", "binary_name": "linux-modules-6.11.0-1001-realtime" }, { "binary_version": "6.11.0-1001.1", "binary_name": "linux-modules-extra-6.11.0-1001-realtime" }, { "binary_version": "6.11.0-1001.1", "binary_name": "linux-modules-iwlwifi-6.11.0-1001-realtime" }, { "binary_version": "6.11.0-1001.1", "binary_name": "linux-realtime-cloud-tools-6.11.0-1001" }, { "binary_version": "6.11.0-1001.1", "binary_name": "linux-realtime-headers-6.11.0-1001" }, { "binary_version": "6.11.0-1001.1", "binary_name": "linux-realtime-tools-6.11.0-1001" }, { "binary_version": "6.11.0-1001.1", "binary_name": "linux-tools-6.11.0-1001-realtime" } ] }
{ "availability": "No subscription required", "ubuntu_priority": "medium", "binaries": [ { "binary_version": "6.11.0-8.8.1", "binary_name": "linux-buildinfo-6.11.0-8-generic" }, { "binary_version": "6.11.0-8.8.1", "binary_name": "linux-headers-6.11.0-8-generic" }, { "binary_version": "6.11.0-8.8.1", "binary_name": "linux-image-6.11.0-8-generic" }, { "binary_version": "6.11.0-8.8.1", "binary_name": "linux-image-6.11.0-8-generic-dbgsym" }, { "binary_version": "6.11.0-8.8.1", "binary_name": "linux-modules-6.11.0-8-generic" }, { "binary_version": "6.11.0-8.8.1", "binary_name": "linux-riscv-headers-6.11.0-8" }, { "binary_version": "6.11.0-8.8.1", "binary_name": "linux-riscv-tools-6.11.0-8" }, { "binary_version": "6.11.0-8.8.1", "binary_name": "linux-tools-6.11.0-8-generic" } ] }