Unverified Commit 6a0da16f authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!9777 CVE-2024-23848 

Merge Pull Request from: @ci-robot 
 
PR sync from: Yongqiang Liu <liuyongqiang13@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/DSTOOEEEW4XZWGGQ7IFLMMTLJHQNIRCN/ 
CVE-2024-23848

Hans Verkuil (2):
  media: cec: cec-adap: always cancel work in cec_transmit_msg_fh
  media: cec: cec-api: add locking in cec_release()


-- 
2.34.1
 
https://gitee.com/src-openeuler/kernel/issues/I8YC89 
 
Link:https://gitee.com/openeuler/kernel/pulls/9777

 

Reviewed-by: default avatarZhang Changzhong <zhangchangzhong@huawei.com>
Signed-off-by: default avatarZhang Changzhong <zhangchangzhong@huawei.com>
parents 1b4ca2a2 60c392ac

drivers/media/cec/cec-adap.c

+1 −2
Original line number Diff line number Diff line
@@ -863,7 +863,6 @@ int cec_transmit_msg_fh(struct cec_adapter *adap, struct cec_msg *msg, 
	 */

	mutex_unlock(&adap->lock);

	wait_for_completion_killable(&data->c);

	if (!data->completed)

	cancel_delayed_work_sync(&data->work);

	mutex_lock(&adap->lock);

drivers/media/cec/cec-api.c

+3 −0
Original line number Diff line number Diff line
@@ -660,6 +660,8 @@ static int cec_release(struct inode *inode, struct file *filp) 
		list_del(&data->xfer_list);

	}

	mutex_unlock(&adap->lock);



	mutex_lock(&fh->lock);

	while (!list_empty(&fh->msgs)) {

		struct cec_msg_entry *entry =

			list_first_entry(&fh->msgs, struct cec_msg_entry, list);
@@ -677,6 +679,7 @@ static int cec_release(struct inode *inode, struct file *filp) 
			kfree(entry);

		}

	}

	mutex_unlock(&fh->lock);

	kfree(fh);



	cec_put_device(devnode);