lkml.org 
[lkml]   [2021]   [Nov]   [15]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.14 378/849] media: em28xx: add missing em28xx_close_extension
    Date
    From: Pavel Skripkin <paskripkin@gmail.com>

    [ Upstream commit 2c98b8a3458df03abdc6945bbef67ef91d181938 ]

    If em28xx dev has ->dev_next pointer, we need to delete ->dev_next list
    node from em28xx_extension_devlist on disconnect to avoid UAF bugs and
    corrupted list bugs, since driver frees this pointer on disconnect.

    Reported-and-tested-by: syzbot+a6969ef522a36d3344c9@syzkaller.appspotmail.com

    Fixes: 1a23f81b7dc3 ("V4L/DVB (9979): em28xx: move usb probe code to a proper place")
    Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
    Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
    Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/media/usb/em28xx/em28xx-cards.c | 5 ++++-
    1 file changed, 4 insertions(+), 1 deletion(-)

    diff --git a/drivers/media/usb/em28xx/em28xx-cards.c b/drivers/media/usb/em28xx/em28xx-cards.c
    index c1e0dccb74088..948e22e29b42a 100644
    --- a/drivers/media/usb/em28xx/em28xx-cards.c
    +++ b/drivers/media/usb/em28xx/em28xx-cards.c
    @@ -4139,8 +4139,11 @@ static void em28xx_usb_disconnect(struct usb_interface *intf)

    em28xx_close_extension(dev);

    - if (dev->dev_next)
    + if (dev->dev_next) {
    + em28xx_close_extension(dev->dev_next);
    em28xx_release_resources(dev->dev_next);
    + }
    +
    em28xx_release_resources(dev);

    if (dev->dev_next) {
    --
    2.33.0


    \
     
     \ /
      Last update: 2021-11-15 23:57    [W:2.174 / U:0.340 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site