From f5d1bea9801c9d0931a9999a91703c74a7b6b6cd Mon Sep 17 00:00:00 2001 From: Takashi Iwai Date: May 19 2023 15:43:47 +0000 Subject: media: ttusb-dec: fix memory leak in ttusb_dec_exit_dvb() (CVE-2022-45887 bsc#1205762). --- diff --git a/patches.suse/media-ttusb-dec-fix-memory-leak-in-ttusb_dec_exit_dv.patch b/patches.suse/media-ttusb-dec-fix-memory-leak-in-ttusb_dec_exit_dv.patch new file mode 100644 index 0000000..572cc45 --- /dev/null +++ b/patches.suse/media-ttusb-dec-fix-memory-leak-in-ttusb_dec_exit_dv.patch @@ -0,0 +1,43 @@ +From 517a281338322ff8293f988771c98aaa7205e457 Mon Sep 17 00:00:00 2001 +From: Hyunwoo Kim +Date: Thu, 17 Nov 2022 04:59:25 +0000 +Subject: [PATCH] media: ttusb-dec: fix memory leak in ttusb_dec_exit_dvb() +Git-commit: 517a281338322ff8293f988771c98aaa7205e457 +Patch-mainline: v6.4-rc3 +References: CVE-2022-45887 bsc#1205762 + +Since dvb_frontend_detach() is not called in ttusb_dec_exit_dvb(), +which is called when the device is disconnected, dvb_frontend_free() +is not finally called. + +This causes a memory leak just by repeatedly plugging and +unplugging the device. + +Fix this issue by adding dvb_frontend_detach() to ttusb_dec_exit_dvb(). + +Link: https://lore.kernel.org/linux-media/20221117045925.14297-5-imv4bel@gmail.com +Signed-off-by: Hyunwoo Kim +Signed-off-by: Mauro Carvalho Chehab +Acked-by: Takashi Iwai + +--- + drivers/media/usb/ttusb-dec/ttusb_dec.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/media/usb/ttusb-dec/ttusb_dec.c b/drivers/media/usb/ttusb-dec/ttusb_dec.c +index 38822cedd93a..c4474d4c44e2 100644 +--- a/drivers/media/usb/ttusb-dec/ttusb_dec.c ++++ b/drivers/media/usb/ttusb-dec/ttusb_dec.c +@@ -1544,8 +1544,7 @@ static void ttusb_dec_exit_dvb(struct ttusb_dec *dec) + dvb_dmx_release(&dec->demux); + if (dec->fe) { + dvb_unregister_frontend(dec->fe); +- if (dec->fe->ops.release) +- dec->fe->ops.release(dec->fe); ++ dvb_frontend_detach(dec->fe); + } + dvb_unregister_adapter(&dec->adapter); + } +-- +2.35.3 + diff --git a/series.conf b/series.conf index 7aeb40c..a333ca2 100644 --- a/series.conf +++ b/series.conf @@ -23124,6 +23124,7 @@ patches.suse/0001-wifi-brcmfmac-slab-out-of-bounds-read-in-brcmf_get_a.patch patches.suse/xfs-verify-buffer-contents-when-we-skip-log-replay.patch patches.suse/netfilter-nf_tables-deactivate-anonymous-set-from-pr.patch + patches.suse/media-ttusb-dec-fix-memory-leak-in-ttusb_dec_exit_dv.patch patches.suse/media-dvb-core-Fix-use-after-free-on-race-condition-.patch patches.suse/media-dvb-core-Fix-use-after-free-due-on-race-condit.patch patches.suse/media-dvb-core-Fix-use-after-free-due-to-race-at-dvb.patch