CVE-2024-49981

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> media: venus: fix use after free bug in venus_remove due to race condition<br /> <br /> in venus_probe, core-&gt;work is bound with venus_sys_error_handler, which is<br /> used to handle error. The code use core-&gt;sys_err_done to make sync work.<br /> The core-&gt;work is started in venus_event_notify.<br /> <br /> If we call venus_remove, there might be an unfished work. The possible<br /> sequence is as follows:<br /> <br /> CPU0 CPU1<br /> <br /> |venus_sys_error_handler<br /> venus_remove |<br /> hfi_destroy |<br /> venus_hfi_destroy |<br /> kfree(hdev); |<br /> |hfi_reinit<br /> |venus_hfi_queues_reinit<br /> |//use hdev<br /> <br /> Fix it by canceling the work in venus_remove.