Double-free in /drivers/media/usb/zr364xx driver

DISCUSSION Dan Carpenter 1 participant 1 message Mar 21, 2018 1 message not in the archive Media (V4L/DVB)

lore

Share & tools

lore

A message that is not in the archive (sent off-list or not yet received): [email protected]

Dan Carpenter

author

2018-03-21 10:04 UTC #1 lore raw

Hi Linux Media Devs,

There is a double free on error in zr364xx_probe(). The bug report explains it pretty well. v4l2_device_unregister() calls zr364xx_release() which frees "cam" but we also to another kfree(cam); before the "return err;".

Please give reported by credit to:

Reported-by "Yavuz, Tuba" <[email protected]>

regards,
dan carpenter

Quoted 37 lines · Tuba

Hello,
It looks like there is a double-free on an error path in the zr364xx_probe function of the zr364xx driver.
fail:
    v4l2_ctrl_handler_free(hdl);
    v4l2_device_unregister(&cam->v4l2_dev);
    =>
        v4l2_device_disconnect
       =>
          put_device
          =>
              kobject_put
              =>
                  kref_put
                  =>
                      v4l2_device_release
                      =>
                          zr364xx_release (CALLBACK)
                          =>
                             kfree(cam)
    kfree(cam);
The vulnerability exists since the initial commit<https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/drivers/media/usb/zr364xx?id=0aa77f6c2954896b132f8b6f2e9f063c52800913> 0aa77f6c2954896b132f8b6f2e9f063c52800913 of the driver.
Best,
Tuba Yavuz, Ph.D.
Assistant Professor
Electrical and Computer Engineering Department
University of Florida
Gainesville, FL 32611
Webpage: http://www.tuba.ece.ufl.edu/
Email: [email protected]
Phone: (352) 846 0202