- Kernel - mailweb.openeuler.org

[PATCH openEuler-1.0-LTS] usb: gadget: udc: renesas_usb3: Fix use after free bug in renesas_usb3_remove due to race condition
by Yongqiang Liu 28 Jun '23

28 Jun '23

From: Zheng Wang <zyytlz.wz(a)163.com> mainline inclusion from mainline-v6.4-rc1 commit 2b947f8769be8b8181dc795fd292d3e7120f5204 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I7EDYS CVE: CVE-2023-35828 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- In renesas_usb3_probe, role_work is bound with renesas_usb3_role_work. renesas_usb3_start will be called to start the work. If we remove the driver which will call usbhs_remove, there may be an unfinished work. The possible sequence is as follows: CPU0 CPU1 renesas_usb3_role_work renesas_usb3_remove usb_role_switch_unregister device_unregister kfree(sw) //free usb3->role_sw usb_role_switch_set_role //use usb3->role_sw The usb3->role_sw could be freed under such circumstance and then used in usb_role_switch_set_role. This bug was found by static analysis. And note that removing a driver is a root-only operation, and should never happen in normal case. But the root user may directly remove the device which will also trigger the remove function. Fix it by canceling the work before cleanup in the renesas_usb3_remove. Fixes: 39facfa01c9f ("usb: gadget: udc: renesas_usb3: Add register of usb role switch") Signed-off-by: Zheng Wang <zyytlz.wz(a)163.com> Reviewed-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh(a)renesas.com> Link: https://lore.kernel.org/r/20230320062931.505170-1-zyytlz.wz@163.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Jialin Zhang <zhangjialin11(a)huawei.com> Reviewed-by: Wei Li <liwei391(a)huawei.com> Reviewed-by: Wang Weiyang <wangweiyang2(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- drivers/usb/gadget/udc/renesas_usb3.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/usb/gadget/udc/renesas_usb3.c b/drivers/usb/gadget/udc/renesas_usb3.c index a5254e82d628..3cbb372db432 100644 --- a/drivers/usb/gadget/udc/renesas_usb3.c +++ b/drivers/usb/gadget/udc/renesas_usb3.c @@ -2477,6 +2477,7 @@ static int renesas_usb3_remove(struct platform_device *pdev) debugfs_remove_recursive(usb3->dentry); device_remove_file(&pdev->dev, &dev_attr_role); + cancel_work_sync(&usb3->role_work); usb_role_switch_unregister(usb3->role_sw); usb_del_gadget_udc(&usb3->gadget); -- 2.25.1

1 0

[PATCH OLK-5.10] mm: shmem: Fix UAF bug in shmem_show_options()
by Tu Jinjiang 28 Jun '23

28 Jun '23

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I78SU1 CVE: NA ------------------------------------------- shmem_show_options() uses sbinfo->mpol without adding it's refcnt. This may lead to race with replacement of the mpol by remount. The execution sequence is as follows. CPU0 CPU1 shmem_show_options() shmem_reconfigure() shmem_show_mpol(seq, sbinfo->mpol) mpol = sbinfo->mpol mpol_put(mpol) mpol->mode The KASAN report is as follows. BUG: KASAN: slab-use-after-free in shmem_show_options+0x21b/0x340 Read of size 2 at addr ffff888124324004 by task mount/2388 Call Trace: <TASK> dump_stack_lvl+0x37/0x50 print_report+0xd0/0x620 ? shmem_show_options+0x21b/0x340 ? __virt_addr_valid+0xf4/0x180 ? shmem_show_options+0x21b/0x340 kasan_report+0xb8/0xe0 ? shmem_show_options+0x21b/0x340 shmem_show_options+0x21b/0x340 ? __pfx_shmem_show_options+0x10/0x10 ? strchr+0x2c/0x50 ? strlen+0x23/0x40 ? seq_puts+0x7d/0x90 show_vfsmnt+0x1e6/0x260 ? __pfx_show_vfsmnt+0x10/0x10 ? __kasan_kmalloc+0x7f/0x90 seq_read_iter+0x57a/0x740 vfs_read+0x2e2/0x4a0 ? __pfx_vfs_read+0x10/0x10 ? down_write_killable+0xb8/0x140 ? __pfx_down_write_killable+0x10/0x10 ? __fget_light+0xa9/0x1e0 ? up_write+0x3f/0x80 ksys_read+0xb8/0x150 ? __pfx_ksys_read+0x10/0x10 ? fpregs_assert_state_consistent+0x55/0x60 ? exit_to_user_mode_prepare+0x2d/0x120 do_syscall_64+0x3c/0x90 entry_SYSCALL_64_after_hwframe+0x72/0xdc </TASK> Allocated by task 2387: kasan_save_stack+0x22/0x50 kasan_set_track+0x25/0x30 __kasan_slab_alloc+0x59/0x70 kmem_cache_alloc+0xdd/0x220 mpol_new+0x83/0x150 mpol_parse_str+0x280/0x4a0 shmem_parse_one+0x364/0x520 vfs_parse_fs_param+0xf8/0x1a0 vfs_parse_fs_string+0xc9/0x130 shmem_parse_options+0xb2/0x110 path_mount+0x597/0xdf0 do_mount+0xcd/0xf0 __x64_sys_mount+0xbd/0x100 do_syscall_64+0x3c/0x90 entry_SYSCALL_64_after_hwframe+0x72/0xdc Freed by task 2389: kasan_save_stack+0x22/0x50 kasan_set_track+0x25/0x30 kasan_save_free_info+0x2e/0x50 __kasan_slab_free+0x10e/0x1a0 kmem_cache_free+0x9c/0x350 shmem_reconfigure+0x278/0x370 reconfigure_super+0x383/0x450 path_mount+0xcc5/0xdf0 do_mount+0xcd/0xf0 __x64_sys_mount+0xbd/0x100 do_syscall_64+0x3c/0x90 entry_SYSCALL_64_after_hwframe+0x72/0xdc The buggy address belongs to the object at ffff888124324000 which belongs to the cache numa_policy of size 32 The buggy address is located 4 bytes inside of freed 32-byte region [ffff888124324000, ffff888124324020) ================================================================== To fix the bug, shmem_get_sbmpol() / mpol_put() needs to be called before / after shmem_show_mpol() call. Signed-off-by: Tu Jinjiang <tujinjiang(a)huawei.com> --- mm/shmem.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/mm/shmem.c b/mm/shmem.c index f7caf1dec81c..93c4a3de558d 100644 --- a/mm/shmem.c +++ b/mm/shmem.c @@ -3637,6 +3637,7 @@ static int shmem_reconfigure(struct fs_context *fc) static int shmem_show_options(struct seq_file *seq, struct dentry *root) { struct shmem_sb_info *sbinfo = SHMEM_SB(root->d_sb); + struct mempolicy *mpol; if (sbinfo->max_blocks != shmem_default_max_blocks()) seq_printf(seq, ",size=%luk", @@ -3679,7 +3680,9 @@ static int shmem_show_options(struct seq_file *seq, struct dentry *root) if (sbinfo->huge) seq_printf(seq, ",huge=%s", shmem_format_huge(sbinfo->huge)); #endif - shmem_show_mpol(seq, sbinfo->mpol); + mpol = shmem_get_sbmpol(sbinfo); + shmem_show_mpol(seq, mpol); + mpol_put(mpol); return 0; } -- 2.25.1

2 1

[PATCH OLK-5.10] drm/msm/dpu: Add check for pstates
by Xia Fukun 28 Jun '23

28 Jun '23

stable inclusion from stable-v5.10.173 commit e9743b3052e125c44b555f07f2876a4bdccfd983 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I7F2UT CVE: CVE-2023-3220 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 93340e10b9c5fc86730d149636e0aa8b47bb5a34 ] As kzalloc may fail and return NULL pointer, it should be better to check pstates in order to avoid the NULL pointer dereference. Fixes: 25fdd5933e4c ("drm/msm: Add SDM845 DPU support") Signed-off-by: Jiasheng Jiang <jiasheng(a)iscas.ac.cn> Reviewed-by: Abhinav Kumar <quic_abhinavk(a)quicinc.com> Patchwork: https://patchwork.freedesktop.org/patch/514160/ Link: https://lore.kernel.org/r/20221206080236.43687-1-jiasheng@iscas.ac.cn Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov(a)linaro.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Xia Fukun <xiafukun(a)huawei.com> --- drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c index f56414a06ec4..9bc4a1cd9ac6 100644 --- a/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c +++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c @@ -831,6 +831,8 @@ static int dpu_crtc_atomic_check(struct drm_crtc *crtc, struct drm_rect crtc_rect = { 0 }; pstates = kzalloc(sizeof(*pstates) * DPU_STAGE_MAX * 4, GFP_KERNEL); + if (!pstates) + return -ENOMEM; if (!state->enable || !state->active) { DPU_DEBUG("crtc%d -> enable %d, active %d, skip atomic_check\n", -- 2.17.1

2 1

openEuler Kernel SIG 双周例会
by openEuler conference 28 Jun '23

28 Jun '23

您好！ Kernel SIG 邀请您参加 2023-06-30 14:00 召开的Zoom会议(自动录制) 会议主题：openEuler Kernel SIG 双周例会会议内容： 1. 进展update 2. 议题征集中欢迎大家积极申报议题（新增议题可以直接回复邮件，或录入会议看板）会议链接：https://us06web.zoom.us/j/81270448575?pwd=WElDeFQ1azluejNHcXR0a3Y4R1VHUT09 会议纪要：https://etherpad.openeuler.org/p/Kernel-meetings 温馨提醒：建议接入会议后修改参会人的姓名，也可以使用您在gitee.com的ID 更多资讯尽在：https://openeuler.org/zh/ Hello! openEuler Kernel SIG invites you to attend the Zoom conference(auto recording) will be held at 2023-06-30 14:00, The subject of the conference is openEuler Kernel SIG 双周例会, Summary: 1. 进展update 2. 议题征集中欢迎大家积极申报议题（新增议题可以直接回复邮件，或录入会议看板） You can join the meeting at https://us06web.zoom.us/j/81270448575?pwd=WElDeFQ1azluejNHcXR0a3Y4R1VHUT09. Add topics at https://etherpad.openeuler.org/p/Kernel-meetings. Note: You are advised to change the participant name after joining the conference or use your ID at gitee.com. More information: https://openeuler.org/en/

1 0

[PATCH OLK-5.10] usb: gadget: udc: renesas_usb3: Fix use after free bug in renesas_usb3_remove due to race condition
by Jialin Zhang 28 Jun '23

28 Jun '23

From: Zheng Wang <zyytlz.wz(a)163.com> mainline inclusion from mainline-v6.4-rc1 commit 2b947f8769be8b8181dc795fd292d3e7120f5204 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I7EDYS CVE: CVE-2023-35828 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- In renesas_usb3_probe, role_work is bound with renesas_usb3_role_work. renesas_usb3_start will be called to start the work. If we remove the driver which will call usbhs_remove, there may be an unfinished work. The possible sequence is as follows: CPU0 CPU1 renesas_usb3_role_work renesas_usb3_remove usb_role_switch_unregister device_unregister kfree(sw) //free usb3->role_sw usb_role_switch_set_role //use usb3->role_sw The usb3->role_sw could be freed under such circumstance and then used in usb_role_switch_set_role. This bug was found by static analysis. And note that removing a driver is a root-only operation, and should never happen in normal case. But the root user may directly remove the device which will also trigger the remove function. Fix it by canceling the work before cleanup in the renesas_usb3_remove. Fixes: 39facfa01c9f ("usb: gadget: udc: renesas_usb3: Add register of usb role switch") Signed-off-by: Zheng Wang <zyytlz.wz(a)163.com> Reviewed-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh(a)renesas.com> Link: https://lore.kernel.org/r/20230320062931.505170-1-zyytlz.wz@163.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Jialin Zhang <zhangjialin11(a)huawei.com> --- drivers/usb/gadget/udc/renesas_usb3.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/usb/gadget/udc/renesas_usb3.c b/drivers/usb/gadget/udc/renesas_usb3.c index 601829a6b4ba..a10f41c4a3f2 100644 --- a/drivers/usb/gadget/udc/renesas_usb3.c +++ b/drivers/usb/gadget/udc/renesas_usb3.c @@ -2568,6 +2568,7 @@ static int renesas_usb3_remove(struct platform_device *pdev) debugfs_remove_recursive(usb3->dentry); device_remove_file(&pdev->dev, &dev_attr_role); + cancel_work_sync(&usb3->role_work); usb_role_switch_unregister(usb3->role_sw); usb_del_gadget_udc(&usb3->gadget); -- 2.25.1

2 1

[PATCH OLK-5.10] ethtool: Fix link extended state for big endian
by Zhengchao Shao 28 Jun '23

28 Jun '23

From: Moshe Tal <moshet(a)nvidia.com> mainline inclusion from mainline-v5.17-rc2 commit e2f08207c558bc0bc8abaa557cdb29bad776ac7b category: feature bugzilla: 188943 CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- The link extended sub-states are assigned as enum that is an integer size but read from a union as u8, this is working for small values on little endian systems but for big endian this always give 0. Fix the variable in the union to match the enum size. Fixes: ecc31c60240b ("ethtool: Add link extended state") Signed-off-by: Moshe Tal <moshet(a)nvidia.com> Reviewed-by: Ido Schimmel <idosch(a)nvidia.com> Tested-by: Ido Schimmel <idosch(a)nvidia.com> Reviewed-by: Gal Pressman <gal(a)nvidia.com> Reviewed-by: Amit Cohen <amcohen(a)nvidia.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Conflicts: include/linux/ethtool.h Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> --- include/linux/ethtool.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/include/linux/ethtool.h b/include/linux/ethtool.h index 726c1b27f3c4..cdfb3cc0951d 100644 --- a/include/linux/ethtool.h +++ b/include/linux/ethtool.h @@ -112,7 +112,7 @@ struct ethtool_link_ext_state_info { enum ethtool_link_ext_substate_link_logical_mismatch link_logical_mismatch; enum ethtool_link_ext_substate_bad_signal_integrity bad_signal_integrity; enum ethtool_link_ext_substate_cable_issue cable_issue; - u8 __link_ext_substate; + u32 __link_ext_substate; }; }; -- 2.34.1

2 1

[PATCH OLK-5.10,v2] ethtool: Fix link extended state for big endian
by Zhengchao Shao 28 Jun '23

28 Jun '23

From: Moshe Tal <moshet(a)nvidia.com> mainline inclusion from mainline-v5.17-rc2 commit e2f08207c558bc0bc8abaa557cdb29bad776ac7b category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I7GNV3 CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- The link extended sub-states are assigned as enum that is an integer size but read from a union as u8, this is working for small values on little endian systems but for big endian this always give 0. Fix the variable in the union to match the enum size. Fixes: ecc31c60240b ("ethtool: Add link extended state") Signed-off-by: Moshe Tal <moshet(a)nvidia.com> Reviewed-by: Ido Schimmel <idosch(a)nvidia.com> Tested-by: Ido Schimmel <idosch(a)nvidia.com> Reviewed-by: Gal Pressman <gal(a)nvidia.com> Reviewed-by: Amit Cohen <amcohen(a)nvidia.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Conflicts: include/linux/ethtool.h Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> --- v2: modify comment --- include/linux/ethtool.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/include/linux/ethtool.h b/include/linux/ethtool.h index 726c1b27f3c4..cdfb3cc0951d 100644 --- a/include/linux/ethtool.h +++ b/include/linux/ethtool.h @@ -112,7 +112,7 @@ struct ethtool_link_ext_state_info { enum ethtool_link_ext_substate_link_logical_mismatch link_logical_mismatch; enum ethtool_link_ext_substate_bad_signal_integrity bad_signal_integrity; enum ethtool_link_ext_substate_cable_issue cable_issue; - u8 __link_ext_substate; + u32 __link_ext_substate; }; }; -- 2.34.1

1 0

[PATCH OLK-5.10 0/2] Two CVE fixes of ksmbd
by ZhaoLong Wang 28 Jun '23

28 Jun '23

CVE fixes: CVE-2023-32255 CVE-2023-32248 *** BLURB HERE *** Namjae Jeon (2): ksmbd: fix memleak in session setup ksmbd: fix NULL pointer dereference in smb2_get_info_filesystem() fs/ksmbd/smb2pdu.c | 7 +++++++ 1 file changed, 7 insertions(+) -- 2.31.1

2 3

[PATCH 0/2] Two CVE fixes of ksmbd
by ZhaoLong Wang 27 Jun '23

27 Jun '23

CVE fixes: CVE-2023-32255 CVE-2023-32248 *** BLURB HERE *** Namjae Jeon (2): ksmbd: fix memleak in session setup ksmbd: fix NULL pointer dereference in smb2_get_info_filesystem() fs/ksmbd/smb2pdu.c | 7 +++++++ 1 file changed, 7 insertions(+) -- 2.31.1

1 2

[PATCH] Add hugetlb_optimize_vmemmap_key and __x86_return_thunk to kabi whitelist
by Jialin Zhang 27 Jun '23

27 Jun '23

bugzilla: https://gitee.com/openeuler/kernel/issues/I7GJJY Signed-off-by: Jialin Zhang <zhangjialin11(a)huawei.com> --- Module.kabi_aarch64 | 1 + Module.kabi_x86_64 | 2 ++ kabi_whitelist_aarch64 | 1 + kabi_whitelist_x86_64 | 2 ++ kernel.spec | 5 ++++- 5 files changed, 10 insertions(+), 1 deletion(-) diff --git a/Module.kabi_aarch64 b/Module.kabi_aarch64 index 104b60e..5aa0dd1 100644 --- a/Module.kabi_aarch64 +++ b/Module.kabi_aarch64 @@ -1111,6 +1111,7 @@ 0x21713595 hrtimer_init vmlinux EXPORT_SYMBOL_GPL 0x8dd504f3 hrtimer_start_range_ns vmlinux EXPORT_SYMBOL_GPL 0xa452f5f1 hrtimer_try_to_cancel vmlinux EXPORT_SYMBOL_GPL +0xbcb36fe4 hugetlb_optimize_vmemmap_key vmlinux EXPORT_SYMBOL 0xdda8dc9c __hw_addr_sync_dev vmlinux EXPORT_SYMBOL 0xc5d47b9a __hw_addr_unsync_dev vmlinux EXPORT_SYMBOL 0xea6847b6 hwmon_device_register vmlinux EXPORT_SYMBOL_GPL diff --git a/Module.kabi_x86_64 b/Module.kabi_x86_64 index 9c3ef26..5159a19 100644 --- a/Module.kabi_x86_64 +++ b/Module.kabi_x86_64 @@ -1236,6 +1236,7 @@ 0x21713595 hrtimer_init vmlinux EXPORT_SYMBOL_GPL 0x8dd504f3 hrtimer_start_range_ns vmlinux EXPORT_SYMBOL_GPL 0xa452f5f1 hrtimer_try_to_cancel vmlinux EXPORT_SYMBOL_GPL +0xbcb36fe4 hugetlb_optimize_vmemmap_key vmlinux EXPORT_SYMBOL 0xf689728b __hw_addr_sync_dev vmlinux EXPORT_SYMBOL 0x8b743647 __hw_addr_unsync_dev vmlinux EXPORT_SYMBOL 0xa3633bba hwmon_device_register vmlinux EXPORT_SYMBOL_GPL @@ -3108,6 +3109,7 @@ 0xd979a547 __x86_indirect_thunk_rdi vmlinux EXPORT_SYMBOL 0xb601be4c __x86_indirect_thunk_rdx vmlinux EXPORT_SYMBOL 0xa1f9a134 __x86_indirect_thunk_rsi vmlinux EXPORT_SYMBOL +0x5b8239ca __x86_return_thunk vmlinux EXPORT_SYMBOL 0x9114b616 __xa_alloc vmlinux EXPORT_SYMBOL 0xb04a43ad __xa_alloc_cyclic vmlinux EXPORT_SYMBOL 0x0a0ebc08 __xa_cmpxchg vmlinux EXPORT_SYMBOL diff --git a/kabi_whitelist_aarch64 b/kabi_whitelist_aarch64 index 58c9450..3ee346e 100644 --- a/kabi_whitelist_aarch64 +++ b/kabi_whitelist_aarch64 @@ -1112,6 +1112,7 @@ hrtimer_init hrtimer_start_range_ns hrtimer_try_to_cancel + hugetlb_optimize_vmemmap_key __hw_addr_sync_dev __hw_addr_unsync_dev hwmon_device_register diff --git a/kabi_whitelist_x86_64 b/kabi_whitelist_x86_64 index 4724b46..4cf5de1 100644 --- a/kabi_whitelist_x86_64 +++ b/kabi_whitelist_x86_64 @@ -1237,6 +1237,7 @@ hrtimer_init hrtimer_start_range_ns hrtimer_try_to_cancel + hugetlb_optimize_vmemmap_key __hw_addr_sync_dev __hw_addr_unsync_dev hwmon_device_register @@ -3109,6 +3110,7 @@ __x86_indirect_thunk_rdi __x86_indirect_thunk_rdx __x86_indirect_thunk_rsi + __x86_return_thunk __xa_alloc __xa_alloc_cyclic __xa_cmpxchg diff --git a/kernel.spec b/kernel.spec index 9ca5de2..8929234 100644 --- a/kernel.spec +++ b/kernel.spec @@ -12,7 +12,7 @@ %global upstream_sublevel 0 %global devel_release 153 %global maintenance_release .12.0 -%global pkg_release .89 +%global pkg_release .90 %define with_debuginfo 1 # Do not recompute the build-id of vmlinux in find-debuginfo.sh @@ -910,6 +910,9 @@ fi %endif %changelog +* Tue Jun 27 2023 Jialin Zhang <zhangjialin11(a)huawei.com> - 5.10.0-153.12.0.90 +- Add hugetlb_optimize_vmemmap_key and __x86_return_thunk to kabi whitelist + * Sun Jun 25 2023 Zheng Zengkai <zhengzengkai(a)huawei.com> - 5.10.0-153.12.0.89 - !1189 [sync] PR-1177: net/sched: flower: fix possible OOB write in fl_set_geneve_opt() - !1226 [sync] PR-1221: media: rkvdec: fix use after free bug in rkvdec_remove -- 2.25.1

1 0