iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

media: em28xx: add missing em28xx_close_extension

Browse Source 
If em28xx dev has ->dev_next pointer, we need to delete ->dev_next list
node from em28xx_extension_devlist on disconnect to avoid UAF bugs and
corrupted list bugs, since driver frees this pointer on disconnect.

Reported-and-tested-by: syzbot+a6969ef522a36d3344c9@syzkaller.appspotmail.com

Fixes: 1a23f81b7d ("V4L/DVB (9979): em28xx: move usb probe code to a proper place")
Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
This commit is contained in:
Pavel Skripkin 2021-07-29 22:23:33 +02:00 committed by Mauro Carvalho Chehab
parent 9015fcc256
commit 2c98b8a345
1 changed files with 4 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
drivers/media/usb/em28xx/em28xx-cards.c
View File

@ -4139,8 +4139,11 @@ static void em28xx_usb_disconnect(struct usb_interface *intf)
em28xx_close_extension(dev);
if (dev->dev_next)
if (dev->dev_next) {
em28xx_close_extension(dev->dev_next);
em28xx_release_resources(dev->dev_next);
}
em28xx_release_resources(dev);
if (dev->dev_next) {