In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
media: ti: vpe: quiesce overflow recovery before freeing streams<\/p>\n
The VIP overflow recovery worker is armed from the hardirq handler when a
\nFIFO overflow is detected, and the list-complete path looks the stream up
\nthrough the VPDMA list private pointer. Both keep touching stream, port
\nand device state; the recovery worker also resets the parser and VPDMA,
\nrepopulates the descriptor list, and re-enables the per-list IRQs.<\/p>\n
vip_stop_streaming() masks and clears the per-list IRQs, but it neither
\nsynchronizes the hardirq handler nor disables recovery_work. An overflow
\nIRQ that has already queued recovery_work, or a list-complete IRQ in
\nflight when the stream is torn down, can therefore still dereference the
\nstream after its resources are released: the descriptor list is freed by
\nvip_release_stream() on file release, and the stream itself by
\nfree_stream() on unbind\/remove.<\/p>\n
Drain the recovery worker and the IRQ handler at both teardown points
\nthrough a shared vip_quiesce_stream() helper, before any stream-owned
\nresource is released. disable_work_sync() cancels pending recovery_work,
\ndrains a running instance, and raises its disable depth, so a subsequent
\nschedule_work() issued by a racing IRQ handler is rejected at the
\nworkqueue scheduler: recovery_work cannot be requeued after
\ndisable_work_sync() takes effect. The worker may still re-enable the
\nper-list IRQs before disable_work_sync() returns; disable_irqs() then
\nmasks those sources and synchronize_irq() waits for any in-flight handler
\nthat still dereferences stream state. In vip_stop_streaming() the helper
\nruns before the parser is stopped, since a worker drained by
\ndisable_work_sync() may re-enable the parser before exiting and would
\notherwise undo the stop. recovery_work is created disabled and enabled in
\nvip_start_streaming() before IRQs, pairing the enable with the teardown
\ndisable across the streaming lifecycle.<\/p>\n
This issue was found by an in-house static analysis tool and confirmed
\nby manual code review.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
media: ti: vpe: quiesce overflow recovery before freeing streams<\/p>\n
The VIP overflow recovery worker is armed from the hardirq handle<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-24562","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/24562","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=24562"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=24562"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=24562"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}