Wind River Support Network

Description

In the Linux kernel, the following vulnerability has been resolved:  media: hackrf: fix to not free memory after the device is registered in hackrf_probe()  In hackrf driver, the following race condition occurs: ``` 		CPU0						CPU1 hackrf_probe()   kzalloc(); // alloc hackrf_dev   ....   v4l2_device_register();   .... 						fd = sys_open("/path/to/dev"); // open hackrf fd 						....   v4l2_device_unregister();   ....   kfree(); // free hackrf_dev   .... 						sys_ioctl(fd, ...); 						  v4l2_ioctl(); 						    video_is_registered() // UAF!! 						.... 						sys_close(fd); 						  v4l2_release() // UAF!! 						    hackrf_video_release() 						      kfree(); // DFB!! ```  When a V4L2 or video device is unregistered, the device node is removed so new open() calls are blocked.  However, file descriptors that are already open-and any in-flight I/O-do not terminate immediately; they remain valid until the last reference is dropped and the driver's release() is invoked.  Therefore, freeing device memory on the error path after hackrf_probe() has registered dev it will lead to a race to use-after-free vuln, since those already-open handles haven't been released yet.  And since release() free memory too, race to use-after-free and double-free vuln occur.  To prevent this, if device is registered from probe(), it should be modified to free memory only through release() rather than calling kfree() directly.