Re: [Linux Kernel Bugs] KASAN: slab-use-after-free Read in cec_queue_msg_fh and 4 other crashes in the cec device (`cec_ioctl`)

[Hans Verkuil <hverkuil-cisco@xs4all.nl>]

On 23/01/2024 09:02, Hans Verkuil wrote:
> On 22/01/2024 20:11, Yang, Chenyuan wrote:
>> Hi Hans,
>>
>> Thank you very much for providing the patch!
>>
>> After running the reproducible programs and 24-hour fuzzing, it seems that this patch could fix the issues 1, 2, 3 and 5.
> 
> Ah, that's good news.
> 
>>
>> The 4th issue, "INFO: task hung in cec_claim_log_addrs", is still triggered after applying the patch.
> 
> I'll dig a bit deeper into this one, see if I can figure out the cause.
> 
> Thank you for your help in testing this!

Can you do another testrun with this patch on top of the previous one?

Thank you!

Regards,

	Hans

Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
---
diff --git a/drivers/media/cec/core/cec-adap.c b/drivers/media/cec/core/cec-adap.c
index 079c3b142d91..7b5dcdf775cc 100644
--- a/drivers/media/cec/core/cec-adap.c
+++ b/drivers/media/cec/core/cec-adap.c
@@ -935,7 +935,8 @@ int cec_transmit_msg_fh(struct cec_adapter *adap, struct cec_msg *msg,
 	 * Release the lock and wait, retake the lock afterwards.
 	 */
 	mutex_unlock(&adap->lock);
-	wait_for_completion_killable(&data->c);
+	wait_for_completion_killable_timeout(&data->c,
+				msecs_to_jiffies(adap->xfer_timeout_ms + 1000));
 	cancel_delayed_work_sync(&data->work);
 	mutex_lock(&adap->lock);