Hyunwoo Kim 42624bc8c3 media: dvb-core: Fix use-after-free due to race condition at dvb_ca_en50221 ... [ Upstream commit 280a8ab817 ] If the device node of dvb_ca_en50221 is open() and the device is disconnected, a UAF may occur when calling close() on the device node. The root cause is that wake_up() and wait_event() for dvbdev->wait_queue are not implemented. So implement wait_event() function in dvb_ca_en50221_release() and add 'remove_mutex' which prevents race condition for 'ca->exit'. [mchehab: fix a checkpatch warning] Link: https://lore.kernel.org/linux-media/20221121063308.GA33821@ubuntu Signed-off-by: Hyunwoo Kim <v4bel@theori.io> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>		2023-06-09 10:32:24 +02:00
..
dmxdev.c	media: dvb-core: Fix UAF due to refcount races at releasing	2023-01-12 11:58:56 +01:00
dvb_ca_en50221.c	media: dvb-core: Fix use-after-free due to race condition at dvb_ca_en50221	2023-06-09 10:32:24 +02:00
dvb_demux.c	media: dvb_demux: fix a bug for the continuity counter	2023-06-09 10:32:22 +02:00
dvb_frontend.c	media: dvb-core: Fix kernel WARNING for blocking operation in wait_event*()	2023-06-09 10:32:24 +02:00
dvb_math.c	media: move dvb kAPI headers to include/media	2017-12-28 13:16:01 -05:00
dvb_net.c	media: dvb-core: Fix use-after-free due on race condition at dvb_net	2023-06-09 10:32:24 +02:00
dvb_ringbuffer.c	docs: Fix some broken references	2018-06-15 18:10:01 -03:00
dvb_vb2.c	media: dvb_vb2: fix possible out of bound access	2022-10-05 10:39:39 +02:00
dvbdev.c	media: dvb-core: Fix use-after-free due to race at dvb_register_device()	2023-06-09 10:32:24 +02:00
Kconfig	media: Kconfig: move DVB-specific options to dvb-core/Kconfig	2020-04-14 10:29:05 +02:00
Makefile	media: dvb: fix DVB_MMAP symbol name	2018-02-23 05:20:01 -05:00