[PATCH] media: dvb-core: Fix UAF in dvb_ca_en50221_io_release()

[PATCH] media: dvb-core: Fix UAF in dvb_ca_en50221_io_release()

[Shuangpeng Bai]

dvb_ca_en50221_io_release() drops the open file's reference to ca
before testing ca->exit and unlocking ca->remove_mutex.

If dvb_ca_en50221_release() concurrently drops the initial
reference, the close path's put can be the final one and free ca. The
following ca->exit access and mutex_unlock() then operate on freed
memory.

Keep the close path's reference until it has finished accessing ca
and released remove_mutex. The reference also keeps ca->dvbdev alive
while the wake-up condition is handled.

Fixes: 280a8ab81733 ("media: dvb-core: Fix use-after-free due to race condition at dvb_ca_en50221")
Cc: stable@vger.kernel.org
Signed-off-by: Shuangpeng Bai <shuangpeng.kernel@gmail.com>
---
 drivers/media/dvb-core/dvb_ca_en50221.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/media/dvb-core/dvb_ca_en50221.c b/drivers/media/dvb-core/dvb_ca_en50221.c
index 1b91ebb8f667..86df28c4aa4b 100644
--- a/drivers/media/dvb-core/dvb_ca_en50221.c
+++ b/drivers/media/dvb-core/dvb_ca_en50221.c
@@ -1787,8 +1787,6 @@ static int dvb_ca_en50221_io_release(struct inode *inode, struct file *file)
 
 	module_put(ca->pub->owner);
 
-	dvb_ca_private_put(ca);
-
 	if (dvbdev->users == 1 && ca->exit == 1) {
 		mutex_unlock(&ca->remove_mutex);
 		wake_up(&dvbdev->wait_queue);
@@ -1796,6 +1794,8 @@ static int dvb_ca_en50221_io_release(struct inode *inode, struct file *file)
 		mutex_unlock(&ca->remove_mutex);
 	}
 
+	dvb_ca_private_put(ca);
+
 	return err;
 }
 
-- 
2.43.0