lkml.org 
[lkml]   [2021]   [Jul]   [4]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH AUTOSEL 4.14 13/25] media: v4l2-core: Avoid the dangling pointer in v4l2_fh_release
    Date
    From: Lv Yunlong <lyl2019@mail.ustc.edu.cn>

    [ Upstream commit 7dd0c9e547b6924e18712b6b51aa3cba1896ee2c ]

    A use after free bug caused by the dangling pointer
    filp->privitate_data in v4l2_fh_release.
    See https://lore.kernel.org/patchwork/patch/1419058/.

    My patch sets the dangling pointer to NULL to provide
    robust.

    Signed-off-by: Lv Yunlong <lyl2019@mail.ustc.edu.cn>
    Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
    Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/media/v4l2-core/v4l2-fh.c | 1 +
    1 file changed, 1 insertion(+)

    diff --git a/drivers/media/v4l2-core/v4l2-fh.c b/drivers/media/v4l2-core/v4l2-fh.c
    index c91a7bd3ecfc..ac8282d059fc 100644
    --- a/drivers/media/v4l2-core/v4l2-fh.c
    +++ b/drivers/media/v4l2-core/v4l2-fh.c
    @@ -104,6 +104,7 @@ int v4l2_fh_release(struct file *filp)
    v4l2_fh_del(fh);
    v4l2_fh_exit(fh);
    kfree(fh);
    + filp->private_data = NULL;
    }
    return 0;
    }
    --
    2.30.2
    \
     
     \ /
      Last update: 2021-07-05 01:40    [W:2.247 / U:0.448 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site