diff options
author | Hyunwoo Kim <imv4bel@gmail.com> | 2022-11-17 07:59:24 +0300 |
---|---|---|
committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2023-06-09 11:34:12 +0300 |
commit | 4a8ecfb2207c498b1d25915919631e2195f9e524 (patch) | |
tree | 8ee02b9ecdf2c8e0e38885de6b9e106e4981faff /include | |
parent | 93b5dfebcb1821dde466e29404fcf1fb919f4c72 (diff) | |
download | linux-4a8ecfb2207c498b1d25915919631e2195f9e524.tar.xz |
media: dvb-core: Fix use-after-free due to race at dvb_register_device()
[ Upstream commit 627bb528b086b4136315c25d6a447a98ea9448d3 ]
dvb_register_device() dynamically allocates fops with kmemdup()
to set the fops->owner.
And these fops are registered in 'file->f_ops' using replace_fops()
in the dvb_device_open() process, and kfree()d in dvb_free_device().
However, it is not common to use dynamically allocated fops instead
of 'static const' fops as an argument of replace_fops(),
and UAF may occur.
These UAFs can occur on any dvb type using dvb_register_device(),
such as dvb_dvr, dvb_demux, dvb_frontend, dvb_net, etc.
So, instead of kfree() the fops dynamically allocated in
dvb_register_device() in dvb_free_device() called during the
.disconnect() process, kfree() it collectively in exit_dvbdev()
called when the dvbdev.c module is removed.
Link: https://lore.kernel.org/linux-media/20221117045925.14297-4-imv4bel@gmail.com
Signed-off-by: Hyunwoo Kim <imv4bel@gmail.com>
Reported-by: kernel test robot <lkp@intel.com>
Reported-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Diffstat (limited to 'include')
-rw-r--r-- | include/media/dvbdev.h | 15 |
1 files changed, 15 insertions, 0 deletions
diff --git a/include/media/dvbdev.h b/include/media/dvbdev.h index ac60c9fcfe9a..34b01ebf3282 100644 --- a/include/media/dvbdev.h +++ b/include/media/dvbdev.h @@ -190,6 +190,21 @@ struct dvb_device { }; /** + * struct dvbdevfops_node - fops nodes registered in dvbdevfops_list + * + * @fops: Dynamically allocated fops for ->owner registration + * @type: type of dvb_device + * @template: dvb_device used for registration + * @list_head: list_head for dvbdevfops_list + */ +struct dvbdevfops_node { + struct file_operations *fops; + enum dvb_device_type type; + const struct dvb_device *template; + struct list_head list_head; +}; + +/** * dvb_device_get - Increase dvb_device reference * * @dvbdev: pointer to struct dvb_device |