summaryrefslogtreecommitdiff
path: root/usr
diff options
context:
space:
mode:
authorHyunwoo Kim <imv4bel@gmail.com>2022-11-17 04:59:23 +0000
committerMauro Carvalho Chehab <mchehab@kernel.org>2023-05-14 06:30:45 +0100
commit4172385b0c9ac366dcab78eda48c26814b87ed1a (patch)
tree59b262bf8c137bd9a375dab83ce6b27d92c6b0e5 /usr
parent6769a0b7ee0c3b31e1b22c3fadff2bfb642de23f (diff)
downloadlinux-4172385b0c9ac366dcab78eda48c26814b87ed1a.tar.gz
linux-4172385b0c9ac366dcab78eda48c26814b87ed1a.tar.bz2
linux-4172385b0c9ac366dcab78eda48c26814b87ed1a.zip
media: dvb-core: Fix use-after-free due on race condition at dvb_net
A race condition may occur between the .disconnect function, which is called when the device is disconnected, and the dvb_device_open() function, which is called when the device node is open()ed. This results in several types of UAFs. The root cause of this is that you use the dvb_device_open() function, which does not implement a conditional statement that checks 'dvbnet->exit'. So, add 'remove_mutex` to protect 'dvbnet->exit' and use locked_dvb_net_open() function to check 'dvbnet->exit'. [mchehab: fix a checkpatch warning] Link: https://lore.kernel.org/linux-media/20221117045925.14297-3-imv4bel@gmail.com Signed-off-by: Hyunwoo Kim <imv4bel@gmail.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
Diffstat (limited to 'usr')
0 files changed, 0 insertions, 0 deletions