diff options
| author | Oliver Neukum <oneukum@suse.com> | 2024-11-26 14:17:22 +0100 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2025-02-08 09:57:52 +0100 |
| commit | 265ecadbe54fdda13adb7fffaca80d1accdb89b0 (patch) | |
| tree | d2246d751f91a7d29bde106d8881d6782a4f9eb5 /drivers/media | |
| parent | e61977c7149468130bd7abb2d59bfa6d9951e31d (diff) | |
| download | linux-265ecadbe54fdda13adb7fffaca80d1accdb89b0.tar.gz linux-265ecadbe54fdda13adb7fffaca80d1accdb89b0.tar.bz2 linux-265ecadbe54fdda13adb7fffaca80d1accdb89b0.zip | |
media: rc: iguanair: handle timeouts
[ Upstream commit b98d5000c50544f14bacb248c34e5219fbe81287 ]
In case of a timeout the IO must be cancelled or
the next IO using the URB will fail and/or overwrite
an operational URB.
The automatic bisection fails because it arrives
at a commit that correctly lets the test case run
without an error.
Signed-off-by: Oliver Neukum <oneukum@suse.com>
Fixes: e99a7cfe93fd ("[media] iguanair: reuse existing urb callback for command responses")
Reported-by: syzbot+ffba8e636870dac0e0c0@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/all/66f5cc9a.050a0220.46d20.0004.GAE@google.com/
Tested-by: syzbot+ffba8e636870dac0e0c0@syzkaller.appspotmail.com
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Diffstat (limited to 'drivers/media')
| -rw-r--r-- | drivers/media/rc/iguanair.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/drivers/media/rc/iguanair.c b/drivers/media/rc/iguanair.c index 276bf3c8a8cb..8af94246e591 100644 --- a/drivers/media/rc/iguanair.c +++ b/drivers/media/rc/iguanair.c @@ -194,8 +194,10 @@ static int iguanair_send(struct iguanair *ir, unsigned size) if (rc) return rc; - if (wait_for_completion_timeout(&ir->completion, TIMEOUT) == 0) + if (wait_for_completion_timeout(&ir->completion, TIMEOUT) == 0) { + usb_kill_urb(ir->urb_out); return -ETIMEDOUT; + } return rc; } |