Commit 68ec0a02 authored Oct 31, 2023 by Dan Carpenter Committed by Greg Kroah-Hartman Jan 25, 2024

media: dvbdev: drop refcount on error path in dvb_device_open()



[ Upstream commit a2dd235df435a05d389240be748909ada91201d2 ]

If call to file->f_op->open() fails, then call dvb_device_put(dvbdev).

Fixes: 0fc044b2b5e2 ("media: dvbdev: adopts refcnt to avoid UAF")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Sasha Levin <sashal@kernel.org>

parent 06a9263a

drivers/media/dvb-core/dvbdev.c

+2 −0

Original line number	Diff line number	Diff line
		@@ -114,6 +114,8 @@ static int dvb_device_open(struct inode inode, struct file file)
		err = file->f_op->open(inode, file);
		up_read(&minor_rwsem);
		mutex_unlock(&dvbdev_mutex);
		if (err)
		dvb_device_put(dvbdev);
		return err;
		}
		fail: