In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
Revert “media: v4l2-dev: fix error handling in __video_register_device()”<\/p>\n
This reverts commit 2a934fdb01db6458288fc9386d3d8ceba6dd551a.<\/p>\n
The intentions of that patch were good, but it doesn’t work.<\/p>\n
The idea is that if device_register fails, you have to do a put_device
\nto let the ref counter release resources.<\/p>\n
However, the V4L2 API says that if video_register_device() fails, then
\nyou have to call video_device_release(), which kfree()s the video_device
\nstruct.<\/p>\n
But the put_device() will already have freed the struct, so you end
\nup in a double-free scenario.<\/p>\n
There is not really a good way of fixing this without breaking
\nvideo_register_device() into two parts, one that initializes everything,
\nand one that does the actual device_register, and then converting all
\nV4L2 drivers to this new model.<\/p>\n
That is a massive job, and it is very unlikely that device_register
\nwill fail.<\/p>\n
So rather than ending up in a double-free scenario, just revert this
\npatch, and in that case we’ll have a small memory leak. Which is a lot
\nmore robust.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
Revert “media: v4l2-dev: fix error handling in __video_register_device()”<\/p>\n
This reverts commit 2a934fdb01db6458288fc9386d3d8ceba6dd<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-21663","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/21663","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=21663"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=21663"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=21663"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}