| From 4fd603b5717a9555e604eb1039e5488a3ee52b32 Mon Sep 17 00:00:00 2001 |
| From: Sasha Levin <sashal@kernel.org> |
| Date: Thu, 15 Aug 2019 09:40:52 -0300 |
| Subject: media: radio/si470x: kill urb on error |
| |
| From: Hans Verkuil <hverkuil-cisco@xs4all.nl> |
| |
| [ Upstream commit 0d616f2a3fdbf1304db44d451d9f07008556923b ] |
| |
| In the probe() function radio->int_in_urb was not killed if an |
| error occurred in the probe sequence. It was also missing in |
| the disconnect. |
| |
| This caused this syzbot issue: |
| |
| https://syzkaller.appspot.com/bug?extid=2d4fc2a0c45ad8da7e99 |
| |
| Reported-and-tested-by: syzbot+2d4fc2a0c45ad8da7e99@syzkaller.appspotmail.com |
| |
| Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> |
| Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org> |
| Signed-off-by: Sasha Levin <sashal@kernel.org> |
| --- |
| drivers/media/radio/si470x/radio-si470x-usb.c | 5 ++++- |
| 1 file changed, 4 insertions(+), 1 deletion(-) |
| |
| diff --git a/drivers/media/radio/si470x/radio-si470x-usb.c b/drivers/media/radio/si470x/radio-si470x-usb.c |
| index 4b132c29f2900..1d045a8c29e21 100644 |
| --- a/drivers/media/radio/si470x/radio-si470x-usb.c |
| +++ b/drivers/media/radio/si470x/radio-si470x-usb.c |
| @@ -742,7 +742,7 @@ static int si470x_usb_driver_probe(struct usb_interface *intf, |
| /* start radio */ |
| retval = si470x_start_usb(radio); |
| if (retval < 0) |
| - goto err_all; |
| + goto err_buf; |
| |
| /* set initial frequency */ |
| si470x_set_freq(radio, 87.5 * FREQ_MUL); /* available in all regions */ |
| @@ -757,6 +757,8 @@ static int si470x_usb_driver_probe(struct usb_interface *intf, |
| |
| return 0; |
| err_all: |
| + usb_kill_urb(radio->int_in_urb); |
| +err_buf: |
| kfree(radio->buffer); |
| err_ctrl: |
| v4l2_ctrl_handler_free(&radio->hdl); |
| @@ -830,6 +832,7 @@ static void si470x_usb_driver_disconnect(struct usb_interface *intf) |
| mutex_lock(&radio->lock); |
| v4l2_device_disconnect(&radio->v4l2_dev); |
| video_unregister_device(&radio->videodev); |
| + usb_kill_urb(radio->int_in_urb); |
| usb_set_intfdata(intf, NULL); |
| mutex_unlock(&radio->lock); |
| v4l2_device_put(&radio->v4l2_dev); |
| -- |
| 2.20.1 |
| |