diff options
| author | Hyunwoo Kim <imv4bel@gmail.com> | 2022-11-17 07:59:23 +0300 |
|---|---|---|
| committer | Mauro Carvalho Chehab <mchehab@kernel.org> | 2023-05-14 08:30:45 +0300 |
| commit | 4172385b0c9ac366dcab78eda48c26814b87ed1a (patch) | |
| tree | 59b262bf8c137bd9a375dab83ce6b27d92c6b0e5 /include | |
| parent | 6769a0b7ee0c3b31e1b22c3fadff2bfb642de23f (diff) | |
| download | linux-4172385b0c9ac366dcab78eda48c26814b87ed1a.tar.xz | |
media: dvb-core: Fix use-after-free due on race condition at dvb_net
A race condition may occur between the .disconnect function, which
is called when the device is disconnected, and the dvb_device_open()
function, which is called when the device node is open()ed.
This results in several types of UAFs.
The root cause of this is that you use the dvb_device_open() function,
which does not implement a conditional statement
that checks 'dvbnet->exit'.
So, add 'remove_mutex` to protect 'dvbnet->exit' and use
locked_dvb_net_open() function to check 'dvbnet->exit'.
[mchehab: fix a checkpatch warning]
Link: https://lore.kernel.org/linux-media/20221117045925.14297-3-imv4bel@gmail.com
Signed-off-by: Hyunwoo Kim <imv4bel@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
Diffstat (limited to 'include')
| -rw-r--r-- | include/media/dvb_net.h | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/include/media/dvb_net.h b/include/media/dvb_net.h index 9980b1dd750b..4a921ea96091 100644 --- a/include/media/dvb_net.h +++ b/include/media/dvb_net.h @@ -39,6 +39,9 @@ struct net_device; * @exit: flag to indicate when the device is being removed. * @demux: pointer to &struct dmx_demux. * @ioctl_mutex: protect access to this struct. + * @remove_mutex: mutex that avoids a race condition between a callback + * called when the hardware is disconnected and the + * file_operations of dvb_net. * * Currently, the core supports up to %DVB_NET_DEVICES_MAX (10) network * devices. @@ -51,6 +54,7 @@ struct dvb_net { unsigned int exit:1; struct dmx_demux *demux; struct mutex ioctl_mutex; + struct mutex remove_mutex; }; /** |