fbdev: smscufx: Fix use-after-free in ufx_ops_open()

[platform/kernel/linux-starfive.git] / drivers / video / fbdev / smscufx.c

diff --git a/drivers/video/fbdev/smscufx.c b/drivers/video/fbdev/smscufx.c
index d7aa551..e65bdc4 100644 (file)
--- a/drivers/video/fbdev/smscufx.c
+++ b/drivers/video/fbdev/smscufx.c
@@ -137,6 +137,8 @@ static int ufx_submit_urb(struct ufx_data *dev, struct urb * urb, size_t len);
 static int ufx_alloc_urb_list(struct ufx_data *dev, int count, size_t size);
 static void ufx_free_urb_list(struct ufx_data *dev);
 
+static DEFINE_MUTEX(disconnect_mutex);
+
 /* reads a control register */
 static int ufx_reg_read(struct ufx_data *dev, u32 index, u32 *data)
 {
@@ -1071,9 +1073,13 @@ static int ufx_ops_open(struct fb_info *info, int user)
        if (user == 0 && !console)
                return -EBUSY;
 
+       mutex_lock(&disconnect_mutex);
+
        /* If the USB device is gone, we don't accept new opens */
-       if (dev->virtualized)
+       if (dev->virtualized) {
+               mutex_unlock(&disconnect_mutex);
                return -ENODEV;
+       }
 
        dev->fb_count++;
 
@@ -1097,6 +1103,8 @@ static int ufx_ops_open(struct fb_info *info, int user)
        pr_debug("open /dev/fb%d user=%d fb_info=%p count=%d",
                info->node, user, info, dev->fb_count);
 
+       mutex_unlock(&disconnect_mutex);
+
        return 0;
 }
 
@@ -1741,6 +1749,8 @@ static void ufx_usb_disconnect(struct usb_interface *interface)
 {
        struct ufx_data *dev;
 
+       mutex_lock(&disconnect_mutex);
+
        dev = usb_get_intfdata(interface);
 
        pr_debug("USB disconnect starting\n");
@@ -1761,6 +1771,8 @@ static void ufx_usb_disconnect(struct usb_interface *interface)
        kref_put(&dev->kref, ufx_free);
 
        /* consider ufx_data freed */
+
+       mutex_unlock(&disconnect_mutex);
 }
 
 static struct usb_driver ufx_driver = {