media: dvb-core: Fix use-after-free on race condition at dvb_frontend
authorHyunwoo Kim <imv4bel@gmail.com>
Thu, 17 Nov 2022 04:59:22 +0000 (04:59 +0000)
committerMauro Carvalho Chehab <mchehab@kernel.org>
Sun, 14 May 2023 05:30:23 +0000 (06:30 +0100)
commit6769a0b7ee0c3b31e1b22c3fadff2bfb642de23f
tree4d2548811b6543a19e2491232f7ade5dc4d18325
parentae11c0efaec32fb45130ee9886689f467232eebc
media: dvb-core: Fix use-after-free on race condition at dvb_frontend

If the device node of dvb_frontend is open() and the device is
disconnected, many kinds of UAFs may occur when calling close()
on the device node.

The root cause of this is that wake_up() for dvbdev->wait_queue
is implemented in the dvb_frontend_release() function, but
wait_event() is not implemented in the dvb_frontend_stop() function.

So, implement wait_event() function in dvb_frontend_stop() and
add 'remove_mutex' which prevents race condition for 'fe->exit'.

[mchehab: fix a couple of checkpatch warnings and some mistakes at the error handling logic]

Link: https://lore.kernel.org/linux-media/20221117045925.14297-2-imv4bel@gmail.com
Signed-off-by: Hyunwoo Kim <imv4bel@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
drivers/media/dvb-core/dvb_frontend.c
include/media/dvb_frontend.h