On 9/25/22 13:03, Hyunwoo Kim wrote:
A race condition may occur if the user physically removes the
USB device while calling open() for this device node.
This is a race condition between the ufx_ops_open() function and
the ufx_usb_disconnect() function, which may eventually result in UAF.
So, add a mutex to the ufx_ops_open() and ufx_usb_disconnect() functions
to avoid race contidion of krefs.
Signed-off-by: Hyunwoo Kim <imv4bel@xxxxxxxxx>
---
drivers/video/fbdev/smscufx.c | 10 ++++++++++
1 file changed, 10 insertions(+)
diff --git a/drivers/video/fbdev/smscufx.c b/drivers/video/fbdev/smscufx.c
index d7aa5511c361..a4378a7241f7 100644
--- a/drivers/video/fbdev/smscufx.c
+++ b/drivers/video/fbdev/smscufx.c
@@ -1065,6 +1067,8 @@ static int ufx_ops_open(struct fb_info *info, int user)
{
struct ufx_data *dev = info->par;
+ mutex_lock(&disconnect_mutex);
+
The next few lines show:
if (user == 0 && !console)
return -EBUSY;
in this case this function exits with the mutex held.
Please check all possible exit paths and unlock the mutex
where necessary.
Helge
