diff options
| author | Shigeru Yoshida <syoshida@redhat.com> | 2022-11-22 21:51:59 +0300 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2022-12-31 15:33:04 +0300 |
| commit | 92b0888398e4ba51d93b618a6506781f4e3879c9 (patch) | |
| tree | 06cda74c1c361b571e9dac51f3c2c5c0c1b40572 /drivers/clk/st | |
| parent | 43e5c20a8b44637da25a2629ca0915467b954bf2 (diff) | |
| download | linux-92b0888398e4ba51d93b618a6506781f4e3879c9.tar.xz | |
media: si470x: Fix use-after-free in si470x_int_in_callback()
[ Upstream commit 7d21e0b1b41b21d628bf2afce777727bd4479aa5 ]
syzbot reported use-after-free in si470x_int_in_callback() [1]. This
indicates that urb->context, which contains struct si470x_device
object, is freed when si470x_int_in_callback() is called.
The cause of this issue is that si470x_int_in_callback() is called for
freed urb.
si470x_usb_driver_probe() calls si470x_start_usb(), which then calls
usb_submit_urb() and si470x_start(). If si470x_start_usb() fails,
si470x_usb_driver_probe() doesn't kill urb, but it just frees struct
si470x_device object, as depicted below:
si470x_usb_driver_probe()
...
si470x_start_usb()
...
usb_submit_urb()
retval = si470x_start()
return retval
if (retval < 0)
free struct si470x_device object, but don't kill urb
This patch fixes this issue by killing urb when si470x_start_usb()
fails and urb is submitted. If si470x_start_usb() fails and urb is
not submitted, i.e. submitting usb fails, it just frees struct
si470x_device object.
Reported-by: syzbot+9ca7a12fd736d93e0232@syzkaller.appspotmail.com
Link: https://syzkaller.appspot.com/bug?id=94ed6dddd5a55e90fd4bab942aa4bb297741d977 [1]
Signed-off-by: Shigeru Yoshida <syoshida@redhat.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Diffstat (limited to 'drivers/clk/st')
0 files changed, 0 insertions, 0 deletions