[PATCH v2] media: dvb-core: synchronize section timer on feed stop

[Kazuki Hanai]

The section filter timeout callback dereferences its dmxdev_filter and
parent dmxdev. dvb_dmxdev_feed_stop() currently uses timer_delete(),
which can return while the callback is already running.

The close path can then release filter-owned resources and allow device
teardown to vfree the filter array while the callback is still executing,
resulting in a use-after-free.

Use timer_delete_sync() at the common section-feed stop boundary. This
waits for an active callback before teardown continues while preserving
timer reuse across DMX_STOP and later filter restarts.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Kazuki Hanai <hnkz.64@xxxxxxxxx>
---
 drivers/media/dvb-core/dmxdev.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

Changes in v2:
- Add Fixes and stable Cc tags.
- Document the pre-rename timer API equivalent for stable backports.

For stable trees predating the timer API rename, the equivalent change is
del_timer_sync().

diff --git a/drivers/media/dvb-core/dmxdev.c b/drivers/media/dvb-core/dmxdev.c
index 6a825d9bae43..0f5a35bf062d 100644
--- a/drivers/media/dvb-core/dmxdev.c
+++ b/drivers/media/dvb-core/dmxdev.c
@@ -486,7 +486,7 @@ static int dvb_dmxdev_feed_stop(struct dmxdev_filter *dmxdevfilter)
 
 	switch (dmxdevfilter->type) {
 	case DMXDEV_TYPE_SEC:
-		timer_delete(&dmxdevfilter->timer);
+		timer_delete_sync(&dmxdevfilter->timer);
 		dmxdevfilter->feed.sec->stop_filtering(dmxdevfilter->feed.sec);
 		break;
 	case DMXDEV_TYPE_PES:
-- 
2.53.0