From: Deepanshu Kartikey <kartikey406@gmail.com>
To: hverkuil@kernel.org, mchehab@kernel.org
Cc: enelsonmoore@gmail.com, sakari.ailus@linux.intel.com,
johan@kernel.org, hansg@kernel.org, linux-media@vger.kernel.org,
linux-kernel@vger.kernel.org,
Deepanshu Kartikey <kartikey406@gmail.com>,
syzbot+537b5eb78cebbff5ea70@syzkaller.appspotmail.com
Subject: [PATCH] media: gspca: don't call stopN/stop0 after device disconnect
Date: Sun, 30 Aug 2026 14:57:12 +0530 [thread overview]
Message-ID: <20260830092712.19452-1-kartikey406@gmail.com> (raw)
gspca_stream_off() calls the sub-driver's stopN() and stop0()
callbacks unconditionally. These issue USB requests using
gspca_dev->dev, which becomes a dangling pointer once the USB device
has been disconnected and freed, causing a use-after-free when the
video device fd is closed after disconnect.
Add a gspca_dev->present check before calling stopN() and stop0(),
matching the existing check already used for gspca_input_create_urb()
in the same function.
Fixes: 1f5965c4dfd7 ("media: gspca: convert to vb2")
Reported-by: syzbot+537b5eb78cebbff5ea70@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=537b5eb78cebbff5ea70
Tested-by: syzbot+537b5eb78cebbff5ea70@syzkaller.appspotmail.com
Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
---
drivers/media/usb/gspca/gspca.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/media/usb/gspca/gspca.c b/drivers/media/usb/gspca/gspca.c
index 594d73e50b9f..5c33cf397f3d 100644
--- a/drivers/media/usb/gspca/gspca.c
+++ b/drivers/media/usb/gspca/gspca.c
@@ -733,14 +733,14 @@ static void gspca_stream_off(struct gspca_dev *gspca_dev)
{
gspca_dev->streaming = false;
gspca_dev->usb_err = 0;
- if (gspca_dev->sd_desc->stopN)
+ if (gspca_dev->present && gspca_dev->sd_desc->stopN)
gspca_dev->sd_desc->stopN(gspca_dev);
destroy_urbs(gspca_dev);
gspca_input_destroy_urb(gspca_dev);
gspca_set_alt0(gspca_dev);
if (gspca_dev->present)
gspca_input_create_urb(gspca_dev);
- if (gspca_dev->sd_desc->stop0)
+ if (gspca_dev->present && gspca_dev->sd_desc->stop0)
gspca_dev->sd_desc->stop0(gspca_dev);
gspca_dbg(gspca_dev, D_STREAM, "stream off OK\n");
}
--
2.43.0
next reply other threads:[~2026-08-30 9:27 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-08-30 9:27 Deepanshu Kartikey [this message]
2026-09-08 9:31 ` [PATCH] media: gspca: don't call stopN/stop0 after device disconnect Hans Verkuil
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260830092712.19452-1-kartikey406@gmail.com \
--to=kartikey406@gmail.com \
--cc=enelsonmoore@gmail.com \
--cc=hansg@kernel.org \
--cc=hverkuil@kernel.org \
--cc=johan@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-media@vger.kernel.org \
--cc=mchehab@kernel.org \
--cc=sakari.ailus@linux.intel.com \
--cc=syzbot+537b5eb78cebbff5ea70@syzkaller.appspotmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.