Adam Crosser c4faab452b gpib: fix double decrement of descriptor_busy in command_ioctl() ...

commit d1857f8296 ("gpib: fix use-after-free in IO ioctl handlers")
introduced a descriptor_busy reference counter to pin struct
gpib_descriptor across IO ioctl operations.  In command_ioctl(), the
error path inside the loop decrements descriptor_busy and breaks, but
execution then falls through to the unconditional decrement after the
loop, underflowing the counter to -1.

This re-enables the use-after-free that the original fix was meant to
prevent: a concurrent close_dev_ioctl() sees descriptor_busy == 0 on
an actively-used descriptor and frees it.

Remove the early decrement from the error path.  The post-loop
decrement already handles all exit paths, matching the correct pattern
used in read_ioctl() and write_ioctl().

Fixes: d1857f8296 ("gpib: fix use-after-free in IO ioctl handlers")
Reported-by: Ruikai Peng <[email protected]>
Signed-off-by: Adam Crosser <[email protected]>
Link: https://patch.msgid.link/[email protected]
Signed-off-by: Greg Kroah-Hartman <[email protected]>

2026-05-23 13:47:34 +02:00

..

gpib_os.c

gpib: fix double decrement of descriptor_busy in command_ioctl()

2026-05-23 13:47:34 +02:00

iblib.c

…

ibsys.h

…

Makefile

…