iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

media: em28xx: Fix use-after-free in em28xx_alloc_urbs

Browse Source 
[ Upstream commit a26efd1961a18b91ae4cd2e433adbcf865b40fa3 ]

When kzalloc() fails, em28xx_uninit_usb_xfer() will free
usb_bufs->buf and set it to NULL. Thus the later access
to usb_bufs->buf[i] will lead to null pointer dereference.
Also the kfree(usb_bufs->buf) after that is redundant.

Fixes: d571b592c6206 ("media: em28xx: don't use coherent buffer for DMA transfers")
Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
Dinghao Liu 2020-12-28 14:02:05 +01:00 committed by Greg Kroah-Hartman
parent 3e0c29a407
commit 57cc424326
1 changed files with 1 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
drivers/media/usb/em28xx/em28xx-core.c
View File

@ -956,14 +956,10 @@ int em28xx_alloc_urbs(struct em28xx *dev, enum em28xx_mode mode, int xfer_bulk,
usb_bufs->buf[i] = kzalloc(sb_size, GFP_KERNEL);
if (!usb_bufs->buf[i]) {
em28xx_uninit_usb_xfer(dev, mode);
for (i--; i >= 0; i--)
kfree(usb_bufs->buf[i]);
kfree(usb_bufs->buf);
usb_bufs->buf = NULL;
em28xx_uninit_usb_xfer(dev, mode);
return -ENOMEM;
}