Hyunwoo Kim d5d61f747e media: dvb-core: Fix use-after-free due to race condition at dvb_ca_en50221 ... [ Upstream commit 280a8ab81733da8bc442253c700a52c4c0886ffd ] If the device node of dvb_ca_en50221 is open() and the device is disconnected, a UAF may occur when calling close() on the device node. The root cause is that wake_up() and wait_event() for dvbdev->wait_queue are not implemented. So implement wait_event() function in dvb_ca_en50221_release() and add 'remove_mutex' which prevents race condition for 'ca->exit'. [mchehab: fix a checkpatch warning] Link: https://lore.kernel.org/linux-media/20221121063308.GA33821@ubuntu Signed-off-by: Hyunwoo Kim <v4bel@theori.io> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>		2023-06-09 10:34:13 +02:00
..
dmxdev.c	media: dvb-core: Fix UAF due to refcount races at releasing	2023-01-07 11:11:49 +01:00
dvb_ca_en50221.c	media: dvb-core: Fix use-after-free due to race condition at dvb_ca_en50221	2023-06-09 10:34:13 +02:00
dvb_demux.c	media: dvb_demux: fix a bug for the continuity counter	2023-06-09 10:34:11 +02:00
dvb_frontend.c	media: dvb-core: Fix kernel WARNING for blocking operation in wait_event*()	2023-06-09 10:34:12 +02:00
dvb_math.c
dvb_net.c	media: dvb-core: Fix use-after-free due on race condition at dvb_net	2023-06-09 10:34:12 +02:00
dvb_ringbuffer.c
dvb_vb2.c	media: dvb_vb2: fix possible out of bound access	2022-09-27 10:24:44 +02:00
dvbdev.c	media: dvb-core: Fix use-after-free due to race at dvb_register_device()	2023-06-09 10:34:12 +02:00
Kconfig	media: Kconfig: cleanup VIDEO_DEV dependencies	2022-03-18 05:58:35 +01:00
Makefile