diff options
| author | Lin Ma <[email protected]> | 2022-08-07 15:59:52 +0100 |
|---|---|---|
| committer | Mauro Carvalho Chehab <[email protected]> | 2022-11-25 10:08:23 +0000 |
| commit | 0fc044b2b5e2d05a1fa1fb0d7f270367a7855d79 (patch) | |
| tree | bbf176c361eb5d46f8b79d923239f42363c5ba9a /net/lapb/lapb_timer.c | |
| parent | 9b7de3c2daf503f86ab0641f377402b8d7f5e485 (diff) | |
media: dvbdev: adopts refcnt to avoid UAF
dvb_unregister_device() is known that prone to use-after-free.
That is, the cleanup from dvb_unregister_device() releases the dvb_device
even if there are pointers stored in file->private_data still refer to it.
This patch adds a reference counter into struct dvb_device and delays its
deallocation until no pointer refers to the object.
Link: https://lore.kernel.org/linux-media/[email protected]
Signed-off-by: Lin Ma <[email protected]>
Reported-by: kernel test robot <[email protected]>
Signed-off-by: Mauro Carvalho Chehab <[email protected]>
Diffstat (limited to 'net/lapb/lapb_timer.c')
0 files changed, 0 insertions, 0 deletions