diff options
| author | Lin Ma <linma@zju.edu.cn> | 2022-08-07 17:59:52 +0300 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2023-01-18 13:30:36 +0300 |
| commit | 219b44bf94203bd433aa91b7796475bf656348e5 (patch) | |
| tree | 47b1c4f87709e0b55f453544821359fdb06d1002 /drivers/media/usb | |
| parent | b4d8fd008de1774d99a5b50acc03d92a1919c3a7 (diff) | |
| download | linux-219b44bf94203bd433aa91b7796475bf656348e5.tar.xz | |
media: dvbdev: adopts refcnt to avoid UAF
[ Upstream commit 0fc044b2b5e2d05a1fa1fb0d7f270367a7855d79 ]
dvb_unregister_device() is known that prone to use-after-free.
That is, the cleanup from dvb_unregister_device() releases the dvb_device
even if there are pointers stored in file->private_data still refer to it.
This patch adds a reference counter into struct dvb_device and delays its
deallocation until no pointer refers to the object.
Link: https://lore.kernel.org/linux-media/20220807145952.10368-1-linma@zju.edu.cn
Signed-off-by: Lin Ma <linma@zju.edu.cn>
Reported-by: kernel test robot <lkp@intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Diffstat (limited to 'drivers/media/usb')
0 files changed, 0 insertions, 0 deletions