| From 8ea70f40d1bce9339135483a88fe54591ebb19f9 Mon Sep 17 00:00:00 2001 |
| From: Oliver Neukum <oneukum@suse.com> |
| Date: Tue, 30 Apr 2019 08:28:14 -0400 |
| Subject: media: uvcvideo: Fix access to uninitialized fields on probe error |
| |
| [ Upstream commit 11a087f484bf15ff65f0a9f277aa5a61fd07ed2a ] |
| |
| We need to check whether this work we are canceling actually is |
| initialized. |
| |
| Signed-off-by: Oliver Neukum <oneukum@suse.com> |
| Reported-by: syzbot+2e1ef9188251d9cc7944@syzkaller.appspotmail.com |
| Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> |
| Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org> |
| Signed-off-by: Sasha Levin <sashal@kernel.org> |
| --- |
| drivers/media/usb/uvc/uvc_ctrl.c | 4 +++- |
| 1 file changed, 3 insertions(+), 1 deletion(-) |
| |
| diff --git a/drivers/media/usb/uvc/uvc_ctrl.c b/drivers/media/usb/uvc/uvc_ctrl.c |
| index 26163a5bde7d..e399b9fad757 100644 |
| --- a/drivers/media/usb/uvc/uvc_ctrl.c |
| +++ b/drivers/media/usb/uvc/uvc_ctrl.c |
| @@ -2345,7 +2345,9 @@ void uvc_ctrl_cleanup_device(struct uvc_device *dev) |
| struct uvc_entity *entity; |
| unsigned int i; |
| |
| - cancel_work_sync(&dev->async_ctrl.work); |
| + /* Can be uninitialized if we are aborting on probe error. */ |
| + if (dev->async_ctrl.work.func) |
| + cancel_work_sync(&dev->async_ctrl.work); |
| |
| /* Free controls and control mappings for all entities. */ |
| list_for_each_entry(entity, &dev->entities, list) { |
| -- |
| 2.20.1 |
| |
