Alan Stern f217cef919 media: usbvision: Fix races among open, close, and disconnect ... commit 9e08117c9d upstream. Visual inspection of the usbvision driver shows that it suffers from three races between its open, close, and disconnect handlers. In particular, the driver is careful to update its usbvision->user and usbvision->remove_pending flags while holding the private mutex, but: usbvision_v4l2_close() and usbvision_radio_close() don't hold the mutex while they check the value of usbvision->remove_pending; usbvision_disconnect() doesn't hold the mutex while checking the value of usbvision->user; and also, usbvision_v4l2_open() and usbvision_radio_open() don't check whether the device has been unplugged before allowing the user to open the device files. Each of these can potentially lead to usbvision_release() being called twice and use-after-free errors. This patch fixes the races by reading the flags while the mutex is still held and checking for pending removes before allowing an open to succeed. Signed-off-by: Alan Stern <stern@rowland.harvard.edu> CC: <stable@vger.kernel.org> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2019-12-01 09:17:39 +01:00
..
Kconfig
Makefile	media: don't include drivers/media/i2c at cflags	2017-12-28 14:14:09 -05:00
usbvision-cards.c	[media] media: Drop FSF's postal address from the source code files	2017-01-27 11:38:09 -02:00
usbvision-cards.h	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
usbvision-core.c	media: media/usbvision: fix spelling mistake: "compresion" -> "compression"	2018-05-09 16:24:02 -04:00
usbvision-i2c.c	media: usb: make i2c_adapter const	2017-08-26 08:41:58 -04:00
usbvision-video.c	media: usbvision: Fix races among open, close, and disconnect	2019-12-01 09:17:39 +01:00
usbvision.h	[media] media/usbvision: remove ctrl_urb_wq	2017-02-03 13:40:20 -02:00