diff options
| author | Pavel Skripkin <paskripkin@gmail.com> | 2021-07-29 22:23:33 +0200 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2021-11-17 09:48:35 +0100 |
| commit | f46da0c6af3af415cf230b2843e8e4898110edf2 (patch) | |
| tree | 83bf1334a21bdb7caebe4170ecb669bb1264693f | |
| parent | 14f3d77c770d4a89f1512707f0e0501f33ab4a6f (diff) | |
| download | linux-f46da0c6af3af415cf230b2843e8e4898110edf2.tar.gz linux-f46da0c6af3af415cf230b2843e8e4898110edf2.tar.bz2 linux-f46da0c6af3af415cf230b2843e8e4898110edf2.zip | |
media: em28xx: add missing em28xx_close_extension
[ Upstream commit 2c98b8a3458df03abdc6945bbef67ef91d181938 ]
If em28xx dev has ->dev_next pointer, we need to delete ->dev_next list
node from em28xx_extension_devlist on disconnect to avoid UAF bugs and
corrupted list bugs, since driver frees this pointer on disconnect.
Reported-and-tested-by: syzbot+a6969ef522a36d3344c9@syzkaller.appspotmail.com
Fixes: 1a23f81b7dc3 ("V4L/DVB (9979): em28xx: move usb probe code to a proper place")
Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
| -rw-r--r-- | drivers/media/usb/em28xx/em28xx-cards.c | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/drivers/media/usb/em28xx/em28xx-cards.c b/drivers/media/usb/em28xx/em28xx-cards.c index 5983e72a0622..3e96b4b711d7 100644 --- a/drivers/media/usb/em28xx/em28xx-cards.c +++ b/drivers/media/usb/em28xx/em28xx-cards.c @@ -4029,8 +4029,11 @@ static void em28xx_usb_disconnect(struct usb_interface *intf) em28xx_close_extension(dev); - if (dev->dev_next) + if (dev->dev_next) { + em28xx_close_extension(dev->dev_next); em28xx_release_resources(dev->dev_next); + } + em28xx_release_resources(dev); if (dev->dev_next) { |