From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Hans Verkuil <hverkuil-cisco@xs4all.nl>,
syzbot+2d4fc2a0c45ad8da7e99@syzkaller.appspotmail.com,
Mauro Carvalho Chehab <mchehab+samsung@kernel.org>,
Sasha Levin <sashal@kernel.org>,
linux-media@vger.kernel.org
Subject: [PATCH AUTOSEL 4.4 24/44] media: radio/si470x: kill urb on error
Date: Sun, 22 Sep 2019 15:00:42 -0400 [thread overview]
Message-ID: <20190922190103.4906-24-sashal@kernel.org> (raw)
In-Reply-To: <20190922190103.4906-1-sashal@kernel.org>
From: Hans Verkuil <hverkuil-cisco@xs4all.nl>
[ Upstream commit 0d616f2a3fdbf1304db44d451d9f07008556923b ]
In the probe() function radio->int_in_urb was not killed if an
error occurred in the probe sequence. It was also missing in
the disconnect.
This caused this syzbot issue:
https://syzkaller.appspot.com/bug?extid=2d4fc2a0c45ad8da7e99
Reported-and-tested-by: syzbot+2d4fc2a0c45ad8da7e99@syzkaller.appspotmail.com
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/radio/si470x/radio-si470x-usb.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/drivers/media/radio/si470x/radio-si470x-usb.c b/drivers/media/radio/si470x/radio-si470x-usb.c
index 091d793f65836..c9347d5aac04f 100644
--- a/drivers/media/radio/si470x/radio-si470x-usb.c
+++ b/drivers/media/radio/si470x/radio-si470x-usb.c
@@ -743,7 +743,7 @@ static int si470x_usb_driver_probe(struct usb_interface *intf,
/* start radio */
retval = si470x_start_usb(radio);
if (retval < 0)
- goto err_all;
+ goto err_buf;
/* set initial frequency */
si470x_set_freq(radio, 87.5 * FREQ_MUL); /* available in all regions */
@@ -758,6 +758,8 @@ static int si470x_usb_driver_probe(struct usb_interface *intf,
return 0;
err_all:
+ usb_kill_urb(radio->int_in_urb);
+err_buf:
kfree(radio->buffer);
err_ctrl:
v4l2_ctrl_handler_free(&radio->hdl);
@@ -831,6 +833,7 @@ static void si470x_usb_driver_disconnect(struct usb_interface *intf)
mutex_lock(&radio->lock);
v4l2_device_disconnect(&radio->v4l2_dev);
video_unregister_device(&radio->videodev);
+ usb_kill_urb(radio->int_in_urb);
usb_set_intfdata(intf, NULL);
mutex_unlock(&radio->lock);
v4l2_device_put(&radio->v4l2_dev);
--
2.20.1
next prev parent reply other threads:[~2019-09-22 19:01 UTC|newest]
Thread overview: 12+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <20190922190103.4906-1-sashal@kernel.org>
2019-09-22 19:00 ` [PATCH AUTOSEL 4.4 05/44] media: dib0700: fix link error for dibx000_i2c_set_speed Sasha Levin
2019-09-22 19:00 ` [PATCH AUTOSEL 4.4 06/44] media: hdpvr: Add device num check and handling Sasha Levin
2019-09-22 19:00 ` [PATCH AUTOSEL 4.4 13/44] media: iguanair: add sanity checks Sasha Levin
2019-09-22 19:00 ` [PATCH AUTOSEL 4.4 20/44] media: gspca: zero usb_buf on error Sasha Levin
2019-09-22 19:00 ` [PATCH AUTOSEL 4.4 22/44] media: omap3isp: Don't set streaming state on random subdevs Sasha Levin
2019-09-22 19:00 ` Sasha Levin [this message]
2019-09-22 19:00 ` [PATCH AUTOSEL 4.4 25/44] media: hdpvr: add terminating 0 at end of string Sasha Levin
2019-09-22 19:00 ` [PATCH AUTOSEL 4.4 26/44] media: saa7146: add cleanup in hexium_attach() Sasha Levin
2019-09-22 19:00 ` [PATCH AUTOSEL 4.4 27/44] media: cpia2_usb: fix memory leaks Sasha Levin
2019-09-22 19:00 ` [PATCH AUTOSEL 4.4 28/44] media: saa7134: fix terminology around saa7134_i2c_eeprom_md7134_gate() Sasha Levin
2019-09-22 19:00 ` [PATCH AUTOSEL 4.4 29/44] media: ov9650: add a sanity check Sasha Levin
2019-09-22 19:01 ` [PATCH AUTOSEL 4.4 42/44] media: ttusb-dec: Fix info-leak in ttusb_dec_send_command() Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20190922190103.4906-24-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=hverkuil-cisco@xs4all.nl \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-media@vger.kernel.org \
--cc=mchehab+samsung@kernel.org \
--cc=stable@vger.kernel.org \
--cc=syzbot+2d4fc2a0c45ad8da7e99@syzkaller.appspotmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).