diff options
| author | Hans Verkuil <hverkuil@xs4all.nl> | 2018-11-13 09:06:46 -0500 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2019-01-26 09:42:51 +0100 |
| commit | f76e38ea42f5241eb8b0ec49db3197735b44320d (patch) | |
| tree | 3a5ad918cd48bc251ddd7457d34d42842946c67f /net/tipc/netlink_compat.c | |
| parent | ac0e225395382a731e6a8ca98419eac9bb43936e (diff) | |
media: vb2: vb2_mmap: move lock up
commit cd26d1c4d1bc947b56ae404998ae2276df7b39b7 upstream.
If a filehandle is dup()ped, then it is possible to close it from one fd
and call mmap from the other. This creates a race condition in vb2_mmap
where it is using queue data that __vb2_queue_free (called from close())
is in the process of releasing.
By moving up the mutex_lock(mmap_lock) in vb2_mmap this race is avoided
since __vb2_queue_free is called with the same mutex locked. So vb2_mmap
now reads consistent buffer data.
Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
Reported-by: syzbot+be93025dd45dccd8923c@syzkaller.appspotmail.com
Signed-off-by: Hans Verkuil <hansverk@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'net/tipc/netlink_compat.c')
0 files changed, 0 insertions, 0 deletions