* [PATCH v3] media: dvb-core: fix use-after-free in dvb_frontend_open()
@ 2026-06-10 8:30 Yun Zhou
2026-06-17 0:29 ` Zhou, Yun
2026-06-25 11:24 ` Zhou, Yun
0 siblings, 2 replies; 5+ messages in thread
From: Yun Zhou @ 2026-06-10 8:30 UTC (permalink / raw)
To: mchehab, kees, linma; +Cc: linux-media, linux-kernel, yun.zhou
dvb_frontend_open() calls dvb_generic_release() in its error path after
dvb_generic_open() succeeds. dvb_generic_release() drops the device
reference via dvb_device_put(), and then dvb_device_open() drops it again
in its error handling, causing a use-after-free and refcount underflow.
Fix this by incrementing the refcount before dvb_generic_release() in the
error path, so that the put inside dvb_generic_release() is balanced and
dvb_device_open() remains the sole effective put on open failure.
Reported-by: syzbot+40339ea82afa8184ad5d@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=40339ea82afa8184ad5d
Cc: stable@vger.kernel.org
Fixes: 0fc044b2b5e2 ("media: dvbdev: adopts refcnt to avoid UAF")
Signed-off-by: Yun Zhou <yun.zhou@windriver.com>
---
v3:
- Simplify fix: increment refcount before dvb_generic_release() instead
of introducing __dvb_generic_release()
v2:
- Fix Fixes tag commit title
- Add Closes: link after Reported-by
- Cc stable@vger.kernel.org
drivers/media/dvb-core/dvb_frontend.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/media/dvb-core/dvb_frontend.c b/drivers/media/dvb-core/dvb_frontend.c
index d082b6c57c76..608525d08277 100644
--- a/drivers/media/dvb-core/dvb_frontend.c
+++ b/drivers/media/dvb-core/dvb_frontend.c
@@ -2887,6 +2887,7 @@ static int dvb_frontend_open(struct inode *inode, struct file *file)
mutex_unlock(&fe->dvb->mdev_lock);
err2:
#endif
+ dvb_device_get(dvbdev);
dvb_generic_release(inode, file);
err1:
if (dvbdev->users == -1 && fe->ops.ts_bus_ctrl)
--
2.43.0
^ permalink raw reply related [flat|nested] 5+ messages in thread* Re: [PATCH v3] media: dvb-core: fix use-after-free in dvb_frontend_open()
2026-06-10 8:30 [PATCH v3] media: dvb-core: fix use-after-free in dvb_frontend_open() Yun Zhou
@ 2026-06-17 0:29 ` Zhou, Yun
2026-06-25 11:24 ` Zhou, Yun
1 sibling, 0 replies; 5+ messages in thread
From: Zhou, Yun @ 2026-06-17 0:29 UTC (permalink / raw)
To: mchehab, kees, linma; +Cc: linux-media, linux-kernel
Friendly ping
On 6/10/26 16:30, Yun Zhou wrote:
> dvb_frontend_open() calls dvb_generic_release() in its error path after
> dvb_generic_open() succeeds. dvb_generic_release() drops the device
> reference via dvb_device_put(), and then dvb_device_open() drops it again
> in its error handling, causing a use-after-free and refcount underflow.
>
> Fix this by incrementing the refcount before dvb_generic_release() in the
> error path, so that the put inside dvb_generic_release() is balanced and
> dvb_device_open() remains the sole effective put on open failure.
>
> Reported-by: syzbot+40339ea82afa8184ad5d@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=40339ea82afa8184ad5d
> Cc: stable@vger.kernel.org
> Fixes: 0fc044b2b5e2 ("media: dvbdev: adopts refcnt to avoid UAF")
> Signed-off-by: Yun Zhou <yun.zhou@windriver.com>
> ---
> v3:
> - Simplify fix: increment refcount before dvb_generic_release() instead
> of introducing __dvb_generic_release()
>
> v2:
> - Fix Fixes tag commit title
> - Add Closes: link after Reported-by
> - Cc stable@vger.kernel.org
>
> drivers/media/dvb-core/dvb_frontend.c | 1 +
> 1 file changed, 1 insertion(+)
>
> diff --git a/drivers/media/dvb-core/dvb_frontend.c b/drivers/media/dvb-core/dvb_frontend.c
> index d082b6c57c76..608525d08277 100644
> --- a/drivers/media/dvb-core/dvb_frontend.c
> +++ b/drivers/media/dvb-core/dvb_frontend.c
> @@ -2887,6 +2887,7 @@ static int dvb_frontend_open(struct inode *inode, struct file *file)
> mutex_unlock(&fe->dvb->mdev_lock);
> err2:
> #endif
> + dvb_device_get(dvbdev);
> dvb_generic_release(inode, file);
> err1:
> if (dvbdev->users == -1 && fe->ops.ts_bus_ctrl)
^ permalink raw reply [flat|nested] 5+ messages in thread* Re: [PATCH v3] media: dvb-core: fix use-after-free in dvb_frontend_open()
2026-06-10 8:30 [PATCH v3] media: dvb-core: fix use-after-free in dvb_frontend_open() Yun Zhou
2026-06-17 0:29 ` Zhou, Yun
@ 2026-06-25 11:24 ` Zhou, Yun
2026-07-02 10:01 ` Zhou, Yun
1 sibling, 1 reply; 5+ messages in thread
From: Zhou, Yun @ 2026-06-25 11:24 UTC (permalink / raw)
To: mchehab, kees, linma; +Cc: linux-media, linux-kernel, yun.zhou
Friendly ping
On 6/10/26 16:30, Yun Zhou wrote:
> dvb_frontend_open() calls dvb_generic_release() in its error path after
> dvb_generic_open() succeeds. dvb_generic_release() drops the device
> reference via dvb_device_put(), and then dvb_device_open() drops it again
> in its error handling, causing a use-after-free and refcount underflow.
>
> Fix this by incrementing the refcount before dvb_generic_release() in the
> error path, so that the put inside dvb_generic_release() is balanced and
> dvb_device_open() remains the sole effective put on open failure.
>
> Reported-by: syzbot+40339ea82afa8184ad5d@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=40339ea82afa8184ad5d
> Cc: stable@vger.kernel.org
> Fixes: 0fc044b2b5e2 ("media: dvbdev: adopts refcnt to avoid UAF")
> Signed-off-by: Yun Zhou <yun.zhou@windriver.com>
> ---
> v3:
> - Simplify fix: increment refcount before dvb_generic_release() instead
> of introducing __dvb_generic_release()
>
> v2:
> - Fix Fixes tag commit title
> - Add Closes: link after Reported-by
> - Cc stable@vger.kernel.org
>
> drivers/media/dvb-core/dvb_frontend.c | 1 +
> 1 file changed, 1 insertion(+)
>
> diff --git a/drivers/media/dvb-core/dvb_frontend.c b/drivers/media/dvb-core/dvb_frontend.c
> index d082b6c57c76..608525d08277 100644
> --- a/drivers/media/dvb-core/dvb_frontend.c
> +++ b/drivers/media/dvb-core/dvb_frontend.c
> @@ -2887,6 +2887,7 @@ static int dvb_frontend_open(struct inode *inode, struct file *file)
> mutex_unlock(&fe->dvb->mdev_lock);
> err2:
> #endif
> + dvb_device_get(dvbdev);
> dvb_generic_release(inode, file);
> err1:
> if (dvbdev->users == -1 && fe->ops.ts_bus_ctrl)
^ permalink raw reply [flat|nested] 5+ messages in thread* Re: [PATCH v3] media: dvb-core: fix use-after-free in dvb_frontend_open()
2026-06-25 11:24 ` Zhou, Yun
@ 2026-07-02 10:01 ` Zhou, Yun
0 siblings, 0 replies; 5+ messages in thread
From: Zhou, Yun @ 2026-07-02 10:01 UTC (permalink / raw)
To: mchehab, kees, linma; +Cc: linux-media, linux-kernel
Friendly ping again
On 6/25/26 19:24, Zhou, Yun wrote:
> Friendly ping
>
> On 6/10/26 16:30, Yun Zhou wrote:
>> dvb_frontend_open() calls dvb_generic_release() in its error path after
>> dvb_generic_open() succeeds. dvb_generic_release() drops the device
>> reference via dvb_device_put(), and then dvb_device_open() drops it again
>> in its error handling, causing a use-after-free and refcount underflow.
>>
>> Fix this by incrementing the refcount before dvb_generic_release() in the
>> error path, so that the put inside dvb_generic_release() is balanced and
>> dvb_device_open() remains the sole effective put on open failure.
>>
>> Reported-by: syzbot+40339ea82afa8184ad5d@syzkaller.appspotmail.com
>> Closes: https://syzkaller.appspot.com/bug?extid=40339ea82afa8184ad5d
>> Cc: stable@vger.kernel.org
>> Fixes: 0fc044b2b5e2 ("media: dvbdev: adopts refcnt to avoid UAF")
>> Signed-off-by: Yun Zhou <yun.zhou@windriver.com>
>> ---
>> v3:
>> - Simplify fix: increment refcount before dvb_generic_release() instead
>> of introducing __dvb_generic_release()
>>
>> v2:
>> - Fix Fixes tag commit title
>> - Add Closes: link after Reported-by
>> - Cc stable@vger.kernel.org
>>
>> drivers/media/dvb-core/dvb_frontend.c | 1 +
>> 1 file changed, 1 insertion(+)
>>
>> diff --git a/drivers/media/dvb-core/dvb_frontend.c b/drivers/media/
>> dvb-core/dvb_frontend.c
>> index d082b6c57c76..608525d08277 100644
>> --- a/drivers/media/dvb-core/dvb_frontend.c
>> +++ b/drivers/media/dvb-core/dvb_frontend.c
>> @@ -2887,6 +2887,7 @@ static int dvb_frontend_open(struct inode
>> *inode, struct file *file)
>> mutex_unlock(&fe->dvb->mdev_lock);
>> err2:
>> #endif
>> + dvb_device_get(dvbdev);
>> dvb_generic_release(inode, file);
>> err1:
>> if (dvbdev->users == -1 && fe->ops.ts_bus_ctrl)
>
^ permalink raw reply [flat|nested] 5+ messages in thread
* [PATCH v3] media: dvb-core: fix use-after-free in dvb_frontend_open()
@ 2026-05-22 3:02 Yun Zhou
0 siblings, 0 replies; 5+ messages in thread
From: Yun Zhou @ 2026-05-22 3:02 UTC (permalink / raw)
To: hdanton, mchehab, kees, linma; +Cc: linux-media, linux-kernel
dvb_frontend_open() calls dvb_generic_release() in its error path after
dvb_generic_open() succeeds. dvb_generic_release() drops the device
reference via dvb_device_put(), and then dvb_device_open() drops it again
in its error handling, causing a use-after-free and refcount underflow.
Fix this by incrementing the refcount before dvb_generic_release() in the
error path, so that the put inside dvb_generic_release() is balanced and
dvb_device_open() remains the sole effective put on open failure.
Reported-by: syzbot+40339ea82afa8184ad5d@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=40339ea82afa8184ad5d
Cc: stable@vger.kernel.org
Fixes: 0fc044b2b5e2 ("media: dvbdev: adopts refcnt to avoid UAF")
Signed-off-by: Yun Zhou <yun.zhou@windriver.com>
---
v3:
- Simplify fix: increment refcount before dvb_generic_release() instead
of introducing __dvb_generic_release()
v2:
- Fix Fixes tag commit title
- Add Closes: link after Reported-by
- Cc stable@vger.kernel.org
drivers/media/dvb-core/dvb_frontend.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/media/dvb-core/dvb_frontend.c b/drivers/media/dvb-core/dvb_frontend.c
index d082b6c57c76..608525d08277 100644
--- a/drivers/media/dvb-core/dvb_frontend.c
+++ b/drivers/media/dvb-core/dvb_frontend.c
@@ -2887,6 +2887,7 @@ static int dvb_frontend_open(struct inode *inode, struct file *file)
mutex_unlock(&fe->dvb->mdev_lock);
err2:
#endif
+ dvb_device_get(dvbdev);
dvb_generic_release(inode, file);
err1:
if (dvbdev->users == -1 && fe->ops.ts_bus_ctrl)
--
2.43.0
^ permalink raw reply related [flat|nested] 5+ messages in thread
end of thread, other threads:[~2026-07-02 10:01 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-06-10 8:30 [PATCH v3] media: dvb-core: fix use-after-free in dvb_frontend_open() Yun Zhou
2026-06-17 0:29 ` Zhou, Yun
2026-06-25 11:24 ` Zhou, Yun
2026-07-02 10:01 ` Zhou, Yun
-- strict thread matches above, loose matches on Subject: below --
2026-05-22 3:02 Yun Zhou
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox