linux/drivers/media/video/cpia2
Jesper Juhl bafefc0cf8 V4L/DVB (4154): Fix use-after-free bug in cpia2 driver
The coverity checker detected a use-after-free error in
drivers/media/video/cpia2/cpia2_v4l.c::cpia2_close() (coverity
error #1281).
What happens is that we lock cam->busy_lock, then proceed to free
resources, and in the case of (--cam->open_count == 0) we finish off by
doing a kfree(cam) and then at the end of the function we do a
mutex_unlock(&cam->busy_lock) which will explode since it'll dereference
the free'd `cam' :
...
mutex_lock(&cam->busy_lock);
...
if (--cam->open_count == 0) {
    ...
    if (!cam->present) {
        video_unregister_device(dev);
        kfree(cam);
    }
}
mutex_unlock(&cam->busy_lock);   <--- PROBLEM, cam no longer around.
...
Since this only happens in the case of open_count going down to zero I
don't see a problem with just releasing the mutex after unregistering the
device and just before the kfree().  In this case there is nothing around
that we can race against; we are in the release method, open_count is zero,
(!cam->present) and the device has just been unregistered, so letting go of
the mutex at this point looks safe to me.
Patch below to implement that solution.
Acked-by: Randy Dunlap <rdunlap@xenotime.net>

Signed-off-by: Jesper Juhl <jesper.juhl@gmail.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>
2006-06-25 02:05:14 -03:00
..
Kconfig V4L/DVB (3527): VIDEO_CPIA2 must depend on USB 2006-03-21 08:53:49 -08:00
Makefile V4L/DVB (3376): Add cpia2 camera support 2006-02-27 00:09:05 -03:00
cpia2.h V4L/DVB (4068): Removed all references to kernel stuff from videodev.h and videodev2.h 2006-06-25 02:05:05 -03:00
cpia2_core.c V4L/DVB (3569): PATCH: switch cpia2 to mutexes and use ioctl 32 compat lib func 2006-03-24 16:26:52 -03:00
cpia2_registers.h V4L/DVB (3376): Add cpia2 camera support 2006-02-27 00:09:05 -03:00
cpia2_usb.c V4L/DVB (3376): Add cpia2 camera support 2006-02-27 00:09:05 -03:00
cpia2_v4l.c V4L/DVB (4154): Fix use-after-free bug in cpia2 driver 2006-06-25 02:05:14 -03:00
cpia2dev.h V4L/DVB (3376): Add cpia2 camera support 2006-02-27 00:09:05 -03:00
cpia2patch.h V4L/DVB (3376): Add cpia2 camera support 2006-02-27 00:09:05 -03:00