627bb528b0
dvb_register_device() dynamically allocates fops with kmemdup() to set the fops->owner. And these fops are registered in 'file->f_ops' using replace_fops() in the dvb_device_open() process, and kfree()d in dvb_free_device(). However, it is not common to use dynamically allocated fops instead of 'static const' fops as an argument of replace_fops(), and UAF may occur. These UAFs can occur on any dvb type using dvb_register_device(), such as dvb_dvr, dvb_demux, dvb_frontend, dvb_net, etc. So, instead of kfree() the fops dynamically allocated in dvb_register_device() in dvb_free_device() called during the .disconnect() process, kfree() it collectively in exit_dvbdev() called when the dvbdev.c module is removed. Link: https://lore.kernel.org/linux-media/20221117045925.14297-4-imv4bel@gmail.com Signed-off-by: Hyunwoo Kim <imv4bel@gmail.com> Reported-by: kernel test robot <lkp@intel.com> Reported-by: Dan Carpenter <error27@gmail.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org> |
||
|---|---|---|
| .. | ||
| davinci | ||
| drv-intf | ||
| i2c | ||
| tpg | ||
| cec-notifier.h | ||
| cec-pin.h | ||
| cec.h | ||
| demux.h | ||
| dmxdev.h | ||
| dvb-usb-ids.h | ||
| dvb_ca_en50221.h | ||
| dvb_demux.h | ||
| dvb_frontend.h | ||
| dvb_math.h | ||
| dvb_net.h | ||
| dvb_ringbuffer.h | ||
| dvb_vb2.h | ||
| dvbdev.h | ||
| frame_vector.h | ||
| imx.h | ||
| media-dev-allocator.h | ||
| media-device.h | ||
| media-devnode.h | ||
| media-entity.h | ||
| media-request.h | ||
| mipi-csi2.h | ||
| ov_16bit_addr_reg_helpers.h | ||
| rc-core.h | ||
| rc-map.h | ||
| rcar-fcp.h | ||
| tuner-types.h | ||
| tuner.h | ||
| tveeprom.h | ||
| v4l2-async.h | ||
| v4l2-common.h | ||
| v4l2-ctrls.h | ||
| v4l2-dev.h | ||
| v4l2-device.h | ||
| v4l2-dv-timings.h | ||
| v4l2-event.h | ||
| v4l2-fh.h | ||
| v4l2-flash-led-class.h | ||
| v4l2-fwnode.h | ||
| v4l2-h264.h | ||
| v4l2-image-sizes.h | ||
| v4l2-ioctl.h | ||
| v4l2-jpeg.h | ||
| v4l2-mc.h | ||
| v4l2-mediabus.h | ||
| v4l2-mem2mem.h | ||
| v4l2-rect.h | ||
| v4l2-subdev.h | ||
| v4l2-vp9.h | ||
| videobuf-core.h | ||
| videobuf-dma-contig.h | ||
| videobuf-dma-sg.h | ||
| videobuf-vmalloc.h | ||
| videobuf2-core.h | ||
| videobuf2-dma-contig.h | ||
| videobuf2-dma-sg.h | ||
| videobuf2-dvb.h | ||
| videobuf2-memops.h | ||
| videobuf2-v4l2.h | ||
| videobuf2-vmalloc.h | ||
| vsp1.h | ||