[PATCH] media: dvbdev: fix missing refcount update in dvb_generic_open()

[PATCH] media: dvbdev: fix missing refcount update in dvb_generic_open()

[Heitor Alves de Siqueira]

After introducing a reference counter to struct dvb_device, it's
possible for a dvbdev to be prematurely freed by dvb_free_device(). This
is due to a missing kref_get() in the dvb_generic_open() path, that was
not balanced with the existing kref_put() in dvb_generic_release().

Add dvb_device_get() to correctly increment the reference counter at the
end of dvb_generic_open(). This also avoids incorrectly increasing the
counter in case of EBUSY errors.

Fixes: 0fc044b2b5e2 ("media: dvbdev: adopts refcnt to avoid UAF")
Reported-by: syzbot+ae466a728017ec940b41@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=ae466a728017ec940b41
Tested-by: syzbot+ae466a728017ec940b41@syzkaller.appspotmail.com
Cc: stable@vger.kernel.org
Signed-off-by: Heitor Alves de Siqueira <halves@igalia.com>
---
 drivers/media/dvb-core/dvbdev.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/media/dvb-core/dvbdev.c b/drivers/media/dvb-core/dvbdev.c
index d753d329502a..84575610253b 100644
--- a/drivers/media/dvb-core/dvbdev.c
+++ b/drivers/media/dvb-core/dvbdev.c
@@ -147,6 +147,7 @@ int dvb_generic_open(struct inode *inode, struct file *file)
 		dvbdev->writers--;
 	}
 
+	dvb_device_get(dvbdev);
 	dvbdev->users--;
 	return 0;
 }

---
base-commit: 1d51b370a0f8f642f4fc84c795fbedac0fcdbbd2
change-id: 20260416-dvbdev-refcount-589bc77e42ef

Best regards,
--  
Heitor Alves de Siqueira <halves@igalia.com>