Duoming Zhou 0f5bb36bf9 media: netup_unidvb: fix use-after-free at del_timer() ... When Universal DVB card is detaching, netup_unidvb_dma_fini() uses del_timer() to stop dma->timeout timer. But when timer handler netup_unidvb_dma_timeout() is running, del_timer() could not stop it. As a result, the use-after-free bug could happen. The process is shown below: (cleanup routine) | (timer routine) | mod_timer(&dev->tx_sim_timer, ..) netup_unidvb_finidev() | (wait a time) netup_unidvb_dma_fini() | netup_unidvb_dma_timeout() del_timer(&dma->timeout); | | ndev->pci_dev->dev //USE Fix by changing del_timer() to del_timer_sync(). Link: https://lore.kernel.org/linux-media/20230308125514.4208-1-duoming@zju.edu.cn Fixes: 52b1eaf4c5 ("[media] netup_unidvb: NetUP Universal DVB-S/S2/T/T2/C PCI-E card driver") Signed-off-by: Duoming Zhou <duoming@zju.edu.cn> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>		2023-05-14 06:28:57 +01:00
..
Kconfig	treewide: Add SPDX license identifier - Makefile/Kconfig	2019-05-21 10:50:46 +02:00
Makefile	media: prefix header search paths with $(srctree)/	2019-05-18 11:49:56 +09:00
netup_unidvb_ci.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 157	2019-05-30 11:26:37 -07:00
netup_unidvb_core.c	media: netup_unidvb: fix use-after-free at del_timer()	2023-05-14 06:28:57 +01:00
netup_unidvb_i2c.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 157	2019-05-30 11:26:37 -07:00
netup_unidvb_spi.c	media: netup_unidvb: Don't leak SPI master in probe error path	2020-12-07 14:18:57 +00:00
netup_unidvb.h	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 157	2019-05-30 11:26:37 -07:00