lisa/android_kernel_xiaomi_sm8350
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

media: dvbdev: drop refcount on error path in dvb_device_open()

Browse Source 
[ Upstream commit a2dd235df435a05d389240be748909ada91201d2 ]

If call to file->f_op->open() fails, then call dvb_device_put(dvbdev).

Fixes: 0fc044b2b5e2 ("media: dvbdev: adopts refcnt to avoid UAF")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
Dan Carpenter 2023-10-31 12:53:33 +03:00 committed by Greg Kroah-Hartman
parent 06a9263ac9
commit 68ec0a0211
1 changed files with 2 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
drivers/media/dvb-core/dvbdev.c
View File

@ -114,6 +114,8 @@ static int dvb_device_open(struct inode *inode, struct file *file)
err = file->f_op->open(inode, file); err = file->f_op->open(inode, file);
up_read(&minor_rwsem); up_read(&minor_rwsem);
mutex_unlock(&dvbdev_mutex); mutex_unlock(&dvbdev_mutex);
if (err)
dvb_device_put(dvbdev);
return err; return err;
} }
fail: fail: