[PATCH] video: fbdev: smscufx: Fix use-after-free in ufx_ops_open()

2022-09-25 Thread Hyunwoo Kim
A race condition may occur if the user physically removes the USB device while calling open() for this device node. This is a race condition between the ufx_ops_open() function and the ufx_usb_disconnect() function, which may eventually result in UAF. So, add a mutex to the ufx_ops_open() and ufx

Re: [PATCH] video: fbdev: smscufx: Fix use-after-free in ufx_ops_open()

2022-09-25 Thread Hyunwoo Kim
On Sun, Sep 25, 2022 at 01:57:46PM +0200, Helge Deller wrote: > On 9/25/22 13:03, Hyunwoo Kim wrote: > > A race condition may occur if the user physically removes the > > USB device while calling open() for this device node. > > > > This is a race condition between the ufx_ops_open() function and

Re: [PATCH] video: fbdev: smscufx: Fix use-after-free in ufx_ops_open()

2022-09-25 Thread Helge Deller
On 9/25/22 13:03, Hyunwoo Kim wrote: A race condition may occur if the user physically removes the USB device while calling open() for this device node. This is a race condition between the ufx_ops_open() function and the ufx_usb_disconnect() function, which may eventually result in UAF. So, ad