After introducing a reference counter to struct dvb_device, it's
possible for a dvbdev to be prematurely freed by dvb_free_device(). This
is due to a missing kref_get() in the dvb_generic_open() path, that was
not balanced with the existing kref_put() in dvb_generic_release().
Add dvb_device_get() to correctly increment the reference counter at the
end of dvb_generic_open(). This also avoids incorrectly increasing the
counter in case of EBUSY errors.
Fixes: 0fc044b2b5e2 ("media: dvbdev: adopts refcnt to avoid UAF")
Reported-by: syzbot+ae466a728017ec940b41@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=ae466a728017ec940b41
Tested-by: syzbot+ae466a728017ec940b41@syzkaller.appspotmail.com
Cc: stable@vger.kernel.org
Signed-off-by: Heitor Alves de Siqueira <halves@igalia.com>
---
drivers/media/dvb-core/dvbdev.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/media/dvb-core/dvbdev.c b/drivers/media/dvb-core/dvbdev.c
index d753d329502a..84575610253b 100644
--- a/drivers/media/dvb-core/dvbdev.c
+++ b/drivers/media/dvb-core/dvbdev.c
@@ -147,6 +147,7 @@ int dvb_generic_open(struct inode *inode, struct file *file)
dvbdev->writers--;
}
+ dvb_device_get(dvbdev);
dvbdev->users--;
return 0;
}
---
base-commit: 1d51b370a0f8f642f4fc84c795fbedac0fcdbbd2
change-id: 20260416-dvbdev-refcount-589bc77e42ef
Best regards,
--
Heitor Alves de Siqueira <halves@igalia.com>