Double-free in /drivers/media/usb/hackrf driver

DISCUSSION Dan Carpenter 1 participant 1 message Mar 20, 2018 1 message not in the archive Media (V4L/DVB)

lore

Share & tools

lore

A message that is not in the archive (sent off-list or not yet received): [email protected]

Dan Carpenter

author

2018-03-20 14:58 UTC #1 lore raw

Hi Linux Media Devs,

This is similar to the one before. Please give reported-by credit to

Reported-by "Yavuz, Tuba" <[email protected]>

Or maybe flip the names around?

The hackrf_probe() function has a double free on error after we set up:

	dev->v4l2_dev.release = hackrf_video_release;
then the calls to:
	video_unregister_device(&dev->rx_vdev);
and
	kfree(dev);

are a double free.

regards,
dan carpenter

Quoted 38 lines · Tuba

Hello,
It looks like there is a double-free vulnerability on an error path in the hackrf_probe function of the hackrf driver.
err_video_unregister_device_rx:
       video_unregister_device(&dev->rx_vdev);
       =>
          v4l2_device_disconnect
          =>
              put_device
              =>
                 kobject_put
                 =>
                    kref_put
                     =>
                        v4l2_device_release
                        =>
                            hackrf_video_release (CALLBACK)
                            =>
                                kfree(dev)
...
err_kfree:
    kfree(dev);
The vulnerability has been introduced with commit 8bc4a9ed85046c214458c9e82aea75d2f46cfffd, which added support for transmitter<https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/drivers/media/usb/hackrf?id=8bc4a9ed85046c214458c9e82aea75d2f46cfffd>.
Best,
Tuba Yavuz, Ph.D.
Assistant Professor
Electrical and Computer Engineering Department
University of Florida
Gainesville, FL 32611
Webpage: http://www.tuba.ece.ufl.edu/
Email: [email protected]
Phone: (352) 846 0202