• Hyunwoo Kim's avatar
    fbdev: smscufx: Fix use-after-free in ufx_ops_open() · 5610bcfe
    Hyunwoo Kim authored
    A race condition may occur if the user physically removes the
    USB device while calling open() for this device node.
    
    This is a race condition between the ufx_ops_open() function and
    the ufx_usb_disconnect() function, which may eventually result in UAF.
    
    So, add a mutex to the ufx_ops_open() and ufx_usb_disconnect() functions
    to avoid race contidion of krefs.
    Signed-off-by: default avatarHyunwoo Kim <imv4bel@gmail.com>
    Cc: stable@vger.kernel.org
    Signed-off-by: default avatarHelge Deller <deller@gmx.de>
    5610bcfe
smscufx.c 53.3 KB