mirror of
https://github.com/torvalds/linux.git
synced 2024-12-23 11:21:33 +00:00
7d21e0b1b4
syzbot reported use-after-free in si470x_int_in_callback() [1]. This indicates that urb->context, which contains struct si470x_device object, is freed when si470x_int_in_callback() is called. The cause of this issue is that si470x_int_in_callback() is called for freed urb. si470x_usb_driver_probe() calls si470x_start_usb(), which then calls usb_submit_urb() and si470x_start(). If si470x_start_usb() fails, si470x_usb_driver_probe() doesn't kill urb, but it just frees struct si470x_device object, as depicted below: si470x_usb_driver_probe() ... si470x_start_usb() ... usb_submit_urb() retval = si470x_start() return retval if (retval < 0) free struct si470x_device object, but don't kill urb This patch fixes this issue by killing urb when si470x_start_usb() fails and urb is submitted. If si470x_start_usb() fails and urb is not submitted, i.e. submitting usb fails, it just frees struct si470x_device object. Reported-by: syzbot+9ca7a12fd736d93e0232@syzkaller.appspotmail.com Link: https://syzkaller.appspot.com/bug?id=94ed6dddd5a55e90fd4bab942aa4bb297741d977 [1] Signed-off-by: Shigeru Yoshida <syoshida@redhat.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> |
||
---|---|---|
.. | ||
si470x | ||
si4713 | ||
wl128x | ||
dsbr100.c | ||
Kconfig | ||
lm7000.h | ||
Makefile | ||
radio-aimslab.c | ||
radio-aztech.c | ||
radio-cadet.c | ||
radio-gemtek.c | ||
radio-isa.c | ||
radio-isa.h | ||
radio-keene.c | ||
radio-ma901.c | ||
radio-maxiradio.c | ||
radio-miropcm20.c | ||
radio-mr800.c | ||
radio-raremono.c | ||
radio-rtrack2.c | ||
radio-sf16fmi.c | ||
radio-sf16fmr2.c | ||
radio-shark2.c | ||
radio-shark.c | ||
radio-si476x.c | ||
radio-tea5764.c | ||
radio-tea5777.c | ||
radio-tea5777.h | ||
radio-terratec.c | ||
radio-timb.c | ||
radio-trust.c | ||
radio-typhoon.c | ||
radio-wl1273.c | ||
radio-zoltrix.c | ||
saa7706h.c | ||
tea575x.c | ||
tef6862.c |