Messages in this thread | | | Date | Mon, 19 Sep 2022 07:51:58 +0200 | From | "Arnd Bergmann" <> | Subject | Re: [PATCH v5] char: pcmcia: synclink_cs: Fix use-after-free in mgslpc_ops |
| |
On Mon, Sep 19, 2022, at 6:02 AM, Hyunwoo Kim wrote: > A race condition may occur if the user physically removes > the pcmcia device while calling ioctl() for this tty device node. > > This is a race condition between the mgslpc_ioctl() function and > the mgslpc_detach() function, which may eventually result in UAF. > > So, add a refcount check to mgslpc_detach() to free the structure > after the tty device node is close()d. > > Signed-off-by: Hyunwoo Kim <imv4bel@gmail.com>
Reviewed-by: Arnd Bergmann <arnd@arndb.de>
| |