Thread (3 messages) 3 messages, 2 authors, 2022-09-26

Re: [PATCH v3] video: fbdev: smscufx: Fix use-after-free in ufx_ops_open()

From: Helge Deller <deller@gmx.de>
Date: 2022-09-25 15:47:39
Also in: dri-devel

On 9/25/22 15:32, Hyunwoo Kim wrote:
A race condition may occur if the user physically removes the
USB device while calling open() for this device node.

This is a race condition between the ufx_ops_open() function and
the ufx_usb_disconnect() function, which may eventually result in UAF.

So, add a mutex to the ufx_ops_open() and ufx_usb_disconnect() functions
to avoid race contidion of krefs.

Signed-off-by: Hyunwoo Kim <redacted>
applied.

Thanks!
Helge
Keyboard shortcuts
hback out one level
jnext message in thread
kprevious message in thread
ldrill in
Escclose help / fold thread tree
?toggle this help