mirror of
https://github.com/torvalds/linux.git
synced 2026-09-21 20:24:02 +02:00
2568a7e083
The l1oip_cleanup() traverses the l1oip_ilist and calls
release_card() to cleanup module and stack. However,
release_card() calls del_timer() to delete the timers
such as keep_tl and timeout_tl. If the timer handler is
running, the del_timer() will not stop it and result in
UAF bugs. One of the processes is shown below:
(cleanup routine) | (timer handler)
release_card() | l1oip_timeout()
... |
del_timer() | ...
... |
kfree(hc) //FREE |
| hc->timeout_on = 0 //USE
Fix by calling del_timer_sync() in release_card(), which
makes sure the timer handlers have finished before the
resources, such as l1oip and so on, have been deallocated.
What's more, the hc->workq and hc->socket_thread can kick
those timers right back in. We add a bool flag to show
if card is released. Then, check this flag in hc->workq
and hc->socket_thread.
Fixes:
|
||
|---|---|---|
| .. | ||
| clock.c | ||
| core.c | ||
| core.h | ||
| dsp_audio.c | ||
| dsp_biquad.h | ||
| dsp_blowfish.c | ||
| dsp_cmx.c | ||
| dsp_core.c | ||
| dsp_dtmf.c | ||
| dsp_ecdis.h | ||
| dsp_hwec.c | ||
| dsp_hwec.h | ||
| dsp_pipeline.c | ||
| dsp_tones.c | ||
| dsp.h | ||
| fsm.c | ||
| fsm.h | ||
| hwchannel.c | ||
| Kconfig | ||
| l1oip_codec.c | ||
| l1oip_core.c | ||
| l1oip.h | ||
| layer1.c | ||
| layer1.h | ||
| layer2.c | ||
| layer2.h | ||
| Makefile | ||
| socket.c | ||
| stack.c | ||
| tei.c | ||
| timerdev.c | ||