diff options
| author | Pavel Skripkin <paskripkin@gmail.com> | 2021-07-29 22:23:33 +0200 |
|---|---|---|
| committer | Mauro Carvalho Chehab <mchehab+huawei@kernel.org> | 2021-09-30 10:07:38 +0200 |
| commit | 2c98b8a3458df03abdc6945bbef67ef91d181938 (patch) | |
| tree | 566d6ac69fe8fbed47fc78587ae564240605ee54 | |
| parent | 9015fcc256d3a74d4fdc3d87877e270968550444 (diff) | |
| download | linux-2c98b8a3458df03abdc6945bbef67ef91d181938.tar.bz2 | |
media: em28xx: add missing em28xx_close_extension
If em28xx dev has ->dev_next pointer, we need to delete ->dev_next list
node from em28xx_extension_devlist on disconnect to avoid UAF bugs and
corrupted list bugs, since driver frees this pointer on disconnect.
Reported-and-tested-by: syzbot+a6969ef522a36d3344c9@syzkaller.appspotmail.com
Fixes: 1a23f81b7dc3 ("V4L/DVB (9979): em28xx: move usb probe code to a proper place")
Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
| -rw-r--r-- | drivers/media/usb/em28xx/em28xx-cards.c | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/drivers/media/usb/em28xx/em28xx-cards.c b/drivers/media/usb/em28xx/em28xx-cards.c index c1e0dccb7408..948e22e29b42 100644 --- a/drivers/media/usb/em28xx/em28xx-cards.c +++ b/drivers/media/usb/em28xx/em28xx-cards.c @@ -4139,8 +4139,11 @@ static void em28xx_usb_disconnect(struct usb_interface *intf) em28xx_close_extension(dev); - if (dev->dev_next) + if (dev->dev_next) { + em28xx_close_extension(dev->dev_next); em28xx_release_resources(dev->dev_next); + } + em28xx_release_resources(dev); if (dev->dev_next) { |