diff options
| author | Hyunwoo Kim <imv4bel@gmail.com> | 2022-11-17 07:59:23 +0300 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2023-06-09 11:34:12 +0300 |
| commit | 93b5dfebcb1821dde466e29404fcf1fb919f4c72 (patch) | |
| tree | e33fc438848b8e1e7e759656032f9b5f1272459f /include/media | |
| parent | bf3b6f82fd4cd0873739610aaafea40ffc97321e (diff) | |
| download | linux-93b5dfebcb1821dde466e29404fcf1fb919f4c72.tar.xz | |
media: dvb-core: Fix use-after-free due on race condition at dvb_net
[ Upstream commit 4172385b0c9ac366dcab78eda48c26814b87ed1a ]
A race condition may occur between the .disconnect function, which
is called when the device is disconnected, and the dvb_device_open()
function, which is called when the device node is open()ed.
This results in several types of UAFs.
The root cause of this is that you use the dvb_device_open() function,
which does not implement a conditional statement
that checks 'dvbnet->exit'.
So, add 'remove_mutex` to protect 'dvbnet->exit' and use
locked_dvb_net_open() function to check 'dvbnet->exit'.
[mchehab: fix a checkpatch warning]
Link: https://lore.kernel.org/linux-media/20221117045925.14297-3-imv4bel@gmail.com
Signed-off-by: Hyunwoo Kim <imv4bel@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Diffstat (limited to 'include/media')
| -rw-r--r-- | include/media/dvb_net.h | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/include/media/dvb_net.h b/include/media/dvb_net.h index 5e31d37f25fa..cc01dffcc9f3 100644 --- a/include/media/dvb_net.h +++ b/include/media/dvb_net.h @@ -41,6 +41,9 @@ * @exit: flag to indicate when the device is being removed. * @demux: pointer to &struct dmx_demux. * @ioctl_mutex: protect access to this struct. + * @remove_mutex: mutex that avoids a race condition between a callback + * called when the hardware is disconnected and the + * file_operations of dvb_net. * * Currently, the core supports up to %DVB_NET_DEVICES_MAX (10) network * devices. @@ -53,6 +56,7 @@ struct dvb_net { unsigned int exit:1; struct dmx_demux *demux; struct mutex ioctl_mutex; + struct mutex remove_mutex; }; /** |