Unverified Commit 31093c04 authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!14014 *** CVE-2024-53063 *** 

Merge Pull Request from: @ci-robot 
 
PR sync from: Zicheng Qu <quzicheng@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/UDGAXWBZMHSMW5ALWC4LY2RFRUYE2JFQ/ 
Mauro Carvalho Chehab (2):
  media: dvbdev: prevent the risk of out of memory access
  media: dvbdev: fix the logic when DVB_DYNAMIC_MINORS is not set


-- 
2.34.1
 
https://gitee.com/src-openeuler/kernel/issues/IB5KR8 
 
Link:https://gitee.com/openeuler/kernel/pulls/14014

 

Reviewed-by: default avatarLi Nan <linan122@huawei.com>
Signed-off-by: default avatarLi Nan <linan122@huawei.com>
parents 50144653 2f3242b6

drivers/media/dvb-core/dvbdev.c

+11 −5
Original line number Diff line number Diff line
@@ -96,10 +96,15 @@ static DECLARE_RWSEM(minor_rwsem); 
static int dvb_device_open(struct inode *inode, struct file *file)

{

	struct dvb_device *dvbdev;

	unsigned int minor = iminor(inode);



	if (minor >= MAX_DVB_MINORS)

		return -ENODEV;



	mutex_lock(&dvbdev_mutex);

	down_read(&minor_rwsem);

	dvbdev = dvb_minors[iminor(inode)];



	dvbdev = dvb_minors[minor];



	if (dvbdev && dvbdev->fops) {

		int err = 0;
@@ -539,7 +544,10 @@ int dvb_register_device(struct dvb_adapter *adap, struct dvb_device **pdvbdev, 
	for (minor = 0; minor < MAX_DVB_MINORS; minor++)

		if (dvb_minors[minor] == NULL)

			break;

	if (minor == MAX_DVB_MINORS) {

#else

	minor = nums2minor(adap->num, type, id);

#endif

	if (minor >= MAX_DVB_MINORS) {

		if (new_node) {

			list_del (&new_node->list_head);

			kfree(dvbdevfops);
@@ -552,9 +560,7 @@ int dvb_register_device(struct dvb_adapter *adap, struct dvb_device **pdvbdev, 
		mutex_unlock(&dvbdev_register_lock);

		return -EINVAL;

	}

#else

	minor = nums2minor(adap->num, type, id);

#endif



	dvbdev->minor = minor;

	dvb_minors[minor] = dvb_device_get(dvbdev);

	up_write(&minor_rwsem);