Description
In the Linux kernel, the following vulnerability has been resolved: media: i2c: ov7740: fix use-after-destroy in remove The ov7740_remove() function had a severe teardown order bug where it destroyed the driver's mutex before freeing the V4L2 control handler which relies on that mutex, leading to a use-after-destroy kernel panic. Furthermore, the driver explicitly called v4l2_ctrl_handler_free() and mutex_destroy() sequentially, but then called ov7740_free_controls() which invokes both of them a second time, resulting in a double-free. This patch fixes the issue by unregistering the subdevice first, and relying exclusively on ov7740_free_controls() to safely tear down the mutex and control handler in the correct order.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
39c5c4471b8d793daf868bd004e56ed420e89707 to < 9e4693436c7dcf8584002500ce4b434b79bbf9edaffected39c5c4471b8d793daf868bd004e56ed420e89707 to < 81e9765878d3ac8ad18e3a683332b5d6bc3a0e33affected39c5c4471b8d793daf868bd004e56ed420e89707 to < 8a02ee6c1c4e88f3a0442bd60d3c77db9a30db5eaffected39c5c4471b8d793daf868bd004e56ed420e89707 to < 7512838a19af0a284a58435292243fad21e57ff1affected39c5c4471b8d793daf868bd004e56ed420e89707 to < 25e2505866c577db2661e4d431f0907c6ec9a3b4affected39c5c4471b8d793daf868bd004e56ed420e89707 to < af81f35e4f429e769b784754e1aa4d7a922470acaffected39c5c4471b8d793daf868bd004e56ed420e89707 to < 09453b467990e8ef8fe09f45a685f9a625248d33affected39c5c4471b8d793daf868bd004e56ed420e89707 to < 5d1b3dea5a44124bab6c14a2d71b977dabed54e7affected
Linux Linux
Default version status: affected
4.16affected0 to < 4.16unaffected5.10.270 to ≤ 5.10.*unaffected5.15.221 to ≤ 5.15.*unaffected6.1.188 to ≤ 6.1.*unaffected6.6.157 to ≤ 6.6.*unaffected6.12.110 to ≤ 6.12.*unaffected6.18.51 to ≤ 6.18.*unaffected7.2.5 to ≤ 7.2.*unaffected7.3 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/9e4693436c7dcf8584002500ce4b434b79bbf9ed ↗
- https://git.kernel.org/stable/c/81e9765878d3ac8ad18e3a683332b5d6bc3a0e33 ↗
- https://git.kernel.org/stable/c/8a02ee6c1c4e88f3a0442bd60d3c77db9a30db5e ↗
- https://git.kernel.org/stable/c/7512838a19af0a284a58435292243fad21e57ff1 ↗
- https://git.kernel.org/stable/c/25e2505866c577db2661e4d431f0907c6ec9a3b4 ↗
- https://git.kernel.org/stable/c/af81f35e4f429e769b784754e1aa4d7a922470ac ↗
- https://git.kernel.org/stable/c/09453b467990e8ef8fe09f45a685f9a625248d33 ↗
- https://git.kernel.org/stable/c/5d1b3dea5a44124bab6c14a2d71b977dabed54e7 ↗