| From d3905557cd2cd8de1cd6617be374001eaa5cc5e4 Mon Sep 17 00:00:00 2001 |
| From: Sasha Levin <sashal@kernel.org> |
| Date: Thu, 29 Jul 2021 22:23:33 +0200 |
| Subject: media: em28xx: add missing em28xx_close_extension |
| |
| From: Pavel Skripkin <paskripkin@gmail.com> |
| |
| [ Upstream commit 2c98b8a3458df03abdc6945bbef67ef91d181938 ] |
| |
| If em28xx dev has ->dev_next pointer, we need to delete ->dev_next list |
| node from em28xx_extension_devlist on disconnect to avoid UAF bugs and |
| corrupted list bugs, since driver frees this pointer on disconnect. |
| |
| Reported-and-tested-by: syzbot+a6969ef522a36d3344c9@syzkaller.appspotmail.com |
| |
| Fixes: 1a23f81b7dc3 ("V4L/DVB (9979): em28xx: move usb probe code to a proper place") |
| Signed-off-by: Pavel Skripkin <paskripkin@gmail.com> |
| Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> |
| Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org> |
| Signed-off-by: Sasha Levin <sashal@kernel.org> |
| --- |
| drivers/media/usb/em28xx/em28xx-cards.c | 5 ++++- |
| 1 file changed, 4 insertions(+), 1 deletion(-) |
| |
| diff --git a/drivers/media/usb/em28xx/em28xx-cards.c b/drivers/media/usb/em28xx/em28xx-cards.c |
| index 5983e72a0622c..3e96b4b711d75 100644 |
| --- a/drivers/media/usb/em28xx/em28xx-cards.c |
| +++ b/drivers/media/usb/em28xx/em28xx-cards.c |
| @@ -4029,8 +4029,11 @@ static void em28xx_usb_disconnect(struct usb_interface *intf) |
| |
| em28xx_close_extension(dev); |
| |
| - if (dev->dev_next) |
| + if (dev->dev_next) { |
| + em28xx_close_extension(dev->dev_next); |
| em28xx_release_resources(dev->dev_next); |
| + } |
| + |
| em28xx_release_resources(dev); |
| |
| if (dev->dev_next) { |
| -- |
| 2.33.0 |
| |
