Skip to content

Fix device removal loop bounds #46

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Shaoen-Lin wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Fix device removal loop bounds #46

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion control.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -119,7 +119,7 @@ static int control_iocontrol_destroy_device(struct vcam_device_spec *dev_spec)
spin_unlock_irqrestore(&dev->in_fh_slock, flags);

spin_lock_irqsave(&ctldev->vcam_devices_lock, flags);
for (i = dev_spec->idx; i < (ctldev->vcam_device_count); i++)
for (i = dev_spec->idx; i + 1 < (ctldev->vcam_device_count); i++)
Copy link
Copy Markdown

@cubic-dev-ai cubic-dev-ai Bot Jun 1, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P0: TOCTOU race condition in device destruction: device pointer captured outside vcam_devices_lock while array mutation happens inside it. Concurrent VCAM_IOCTL_DESTROY_DEVICE calls on different indices can leave a dangling pointer in vcam_devices after one thread frees the device, causing UAF on later access.

Prompt for AI agents 
Check if this issue is valid — if so, understand the root cause and fix it. At control.c, line 122:

<comment>TOCTOU race condition in device destruction: device pointer captured outside `vcam_devices_lock` while array mutation happens inside it. Concurrent `VCAM_IOCTL_DESTROY_DEVICE` calls on different indices can leave a dangling pointer in `vcam_devices` after one thread frees the device, causing UAF on later access.</comment>

<file context>
@@ -119,7 +119,7 @@ static int control_iocontrol_destroy_device(struct vcam_device_spec *dev_spec)
 
     spin_lock_irqsave(&ctldev->vcam_devices_lock, flags);
-    for (i = dev_spec->idx; i < (ctldev->vcam_device_count); i++)
+    for (i = dev_spec->idx; i + 1 < (ctldev->vcam_device_count); i++)
         ctldev->vcam_devices[i] = ctldev->vcam_devices[i + 1];
     ctldev->vcam_devices[--ctldev->vcam_device_count] = NULL;
</file context>

ctldev->vcam_devices[i] = ctldev->vcam_devices[i + 1];
ctldev->vcam_devices[--ctldev->vcam_device_count] = NULL;
spin_unlock_irqrestore(&ctldev->vcam_devices_lock, flags);
Expand Down
Loading