[PATCH v2] video: fbdev: smscufx: Fix use-after-free in ufx_ops_open()

2022-09-25 Thread Hyunwoo Kim
A race condition may occur if the user physically removes the USB device while calling open() for this device node. This is a race condition between the ufx_ops_open() function and the ufx_usb_disconnect() function, which may eventually result in UAF. So, add a mutex to the ufx_ops_open() and ufx

Re: [PATCH v2] video: fbdev: smscufx: Fix use-after-free in ufx_ops_open()

2022-09-25 Thread Hyunwoo Kim
On Sun, Sep 25, 2022 at 03:09:47PM +0200, Helge Deller wrote: > it seems user and console don't need to be protected by the lock. > Does it make sense to move them out of the lock? you're right. Since both variables are not related to a race condition, it is better to get them out of the lock. I

Re: [PATCH v2] video: fbdev: smscufx: Fix use-after-free in ufx_ops_open()

2022-09-25 Thread Helge Deller
On 9/25/22 14:32, Hyunwoo Kim wrote: A race condition may occur if the user physically removes the USB device while calling open() for this device node. This is a race condition between the ufx_ops_open() function and the ufx_usb_disconnect() function, which may eventually result in UAF. So, ad