media: dvb-core: Fix use-after-free due to race condition at dvb_ca_en50221
authorHyunwoo Kim <v4bel@theori.io>
Mon, 21 Nov 2022 06:33:08 +0000 (06:33 +0000)
committerMauro Carvalho Chehab <mchehab@kernel.org>
Sun, 14 May 2023 15:04:48 +0000 (16:04 +0100)
commit280a8ab81733da8bc442253c700a52c4c0886ffd
tree8d296b8d536954eb9849cfceeef24951c6deed0d
parentb8c75e4a1b325ea0a9433fa8834be97b5836b946
media: dvb-core: Fix use-after-free due to race condition at dvb_ca_en50221

If the device node of dvb_ca_en50221 is open() and the
device is disconnected, a UAF may occur when calling
close() on the device node.

The root cause is that wake_up() and wait_event() for
dvbdev->wait_queue are not implemented.

So implement wait_event() function in dvb_ca_en50221_release()
and add 'remove_mutex' which prevents race condition
for 'ca->exit'.

[mchehab: fix a checkpatch warning]

Link: https://lore.kernel.org/linux-media/20221121063308.GA33821@ubuntu
Signed-off-by: Hyunwoo Kim <v4bel@theori.io>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
drivers/media/dvb-core/dvb_ca_en50221.c