summaryrefslogtreecommitdiffstats
path: root/drivers/media/usb/em28xx
diff options
context:
space:
mode:
authorDinghao Liu <dinghao.liu@zju.edu.cn>2020-12-28 14:02:05 +0100
committerMauro Carvalho Chehab <mchehab+huawei@kernel.org>2021-01-12 18:21:07 +0100
commita26efd1961a18b91ae4cd2e433adbcf865b40fa3 (patch)
tree1975264fedb673db43796ec5867ff73bbcb2bfb0 /drivers/media/usb/em28xx
parentdbfa04ec61b7e68259efcdef39b1c637bfedf264 (diff)
downloadlinux-a26efd1961a18b91ae4cd2e433adbcf865b40fa3.tar.bz2
media: em28xx: Fix use-after-free in em28xx_alloc_urbs
When kzalloc() fails, em28xx_uninit_usb_xfer() will free usb_bufs->buf and set it to NULL. Thus the later access to usb_bufs->buf[i] will lead to null pointer dereference. Also the kfree(usb_bufs->buf) after that is redundant. Fixes: d571b592c6206 ("media: em28xx: don't use coherent buffer for DMA transfers") Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Diffstat (limited to 'drivers/media/usb/em28xx')
-rw-r--r--drivers/media/usb/em28xx/em28xx-core.c6
1 files changed, 1 insertions, 5 deletions
diff --git a/drivers/media/usb/em28xx/em28xx-core.c b/drivers/media/usb/em28xx/em28xx-core.c
index e6088b5d1b80..3daa64bb1e1d 100644
--- a/drivers/media/usb/em28xx/em28xx-core.c
+++ b/drivers/media/usb/em28xx/em28xx-core.c
@@ -956,14 +956,10 @@ int em28xx_alloc_urbs(struct em28xx *dev, enum em28xx_mode mode, int xfer_bulk,
usb_bufs->buf[i] = kzalloc(sb_size, GFP_KERNEL);
if (!usb_bufs->buf[i]) {
- em28xx_uninit_usb_xfer(dev, mode);
-
for (i--; i >= 0; i--)
kfree(usb_bufs->buf[i]);
- kfree(usb_bufs->buf);
- usb_bufs->buf = NULL;
-
+ em28xx_uninit_usb_xfer(dev, mode);
return -ENOMEM;
}