lkml.org 
[lkml]   [2023]   [Jan]   [20]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
SubjectRe: [PATCH] media:cec:fix double free and uaf issue when cancel data during noblocking
From
On 19/01/2023 05:49, Xinghui Li wrote:
> 在 2023/1/18 18:18,“Hans Verkuil”<hverkuil-cisco@xs4all.nl <mailto:hverkuil-cisco@xs4all.nl>> 写入:
>
>> ...while this free is called if data->blocking is true. (see the 'if (!block) return 0;'
>> further up).
> Do you mean this code?
>
> /* All done if we don't need to block waiting for completion */
> if (!block)
> return 0;

Yes.

> I notice this part code. But I'm not sure if 'block' will be modified in other sync operations.
> So I sent this patch for community to review.

It's not modified anywhere else.

>
>> So I have my doubts if this patch actually addresses the correct issue.
>> Do you have an actual debug trace of the UAF? Or even better, code to reproduce
>> this issue.
>
> And we found this issue by the code scanning tool developed by loydlv and filtered from 200 issue by human.
> So it could be the none-issue. If so, I hope I didn't waste too much of your time.

I'll reject this patch since I believe this to be a false report. For future reference:
if a patch is based on code scanning tools then it's good to mention that in the commit
log. I wasn't aware that 'loydlv' is such a tool.

Regards,

Hans

\
 
 \ /
  Last update: 2023-03-26 23:48    [W:0.056 / U:0.204 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site