diff options
author | Hyunwoo Kim <imv4bel@gmail.com> | 2022-11-17 04:59:23 +0000 |
---|---|---|
committer | Mauro Carvalho Chehab <mchehab@kernel.org> | 2023-05-14 06:30:45 +0100 |
commit | 4172385b0c9ac366dcab78eda48c26814b87ed1a (patch) | |
tree | 59b262bf8c137bd9a375dab83ce6b27d92c6b0e5 /drivers/vdpa | |
parent | 6769a0b7ee0c3b31e1b22c3fadff2bfb642de23f (diff) | |
download | linux-4172385b0c9ac366dcab78eda48c26814b87ed1a.tar.gz linux-4172385b0c9ac366dcab78eda48c26814b87ed1a.tar.bz2 linux-4172385b0c9ac366dcab78eda48c26814b87ed1a.zip |
media: dvb-core: Fix use-after-free due on race condition at dvb_net
A race condition may occur between the .disconnect function, which
is called when the device is disconnected, and the dvb_device_open()
function, which is called when the device node is open()ed.
This results in several types of UAFs.
The root cause of this is that you use the dvb_device_open() function,
which does not implement a conditional statement
that checks 'dvbnet->exit'.
So, add 'remove_mutex` to protect 'dvbnet->exit' and use
locked_dvb_net_open() function to check 'dvbnet->exit'.
[mchehab: fix a checkpatch warning]
Link: https://lore.kernel.org/linux-media/20221117045925.14297-3-imv4bel@gmail.com
Signed-off-by: Hyunwoo Kim <imv4bel@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
Diffstat (limited to 'drivers/vdpa')
0 files changed, 0 insertions, 0 deletions