diff options
| author | Hyunwoo Kim <imv4bel@gmail.com> | 2022-11-17 04:59:22 +0000 |
|---|---|---|
| committer | Mauro Carvalho Chehab <mchehab@kernel.org> | 2023-05-14 06:30:23 +0100 |
| commit | 6769a0b7ee0c3b31e1b22c3fadff2bfb642de23f (patch) | |
| tree | 4d2548811b6543a19e2491232f7ade5dc4d18325 /include | |
| parent | ae11c0efaec32fb45130ee9886689f467232eebc (diff) | |
media: dvb-core: Fix use-after-free on race condition at dvb_frontend
If the device node of dvb_frontend is open() and the device is
disconnected, many kinds of UAFs may occur when calling close()
on the device node.
The root cause of this is that wake_up() for dvbdev->wait_queue
is implemented in the dvb_frontend_release() function, but
wait_event() is not implemented in the dvb_frontend_stop() function.
So, implement wait_event() function in dvb_frontend_stop() and
add 'remove_mutex' which prevents race condition for 'fe->exit'.
[mchehab: fix a couple of checkpatch warnings and some mistakes at the error handling logic]
Link: https://lore.kernel.org/linux-media/20221117045925.14297-2-imv4bel@gmail.com
Signed-off-by: Hyunwoo Kim <imv4bel@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
Diffstat (limited to 'include')
| -rw-r--r-- | include/media/dvb_frontend.h | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/include/media/dvb_frontend.h b/include/media/dvb_frontend.h index e7c44870f20d..367d5381217b 100644 --- a/include/media/dvb_frontend.h +++ b/include/media/dvb_frontend.h @@ -686,7 +686,10 @@ struct dtv_frontend_properties { * @id: Frontend ID * @exit: Used to inform the DVB core that the frontend * thread should exit (usually, means that the hardware - * got disconnected. + * got disconnected). + * @remove_mutex: mutex that avoids a race condition between a callback + * called when the hardware is disconnected and the + * file_operations of dvb_frontend. */ struct dvb_frontend { @@ -704,6 +707,7 @@ struct dvb_frontend { int (*callback)(void *adapter_priv, int component, int cmd, int arg); int id; unsigned int exit; + struct mutex remove_mutex; }; /** |