From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755396AbdKJAVj (ORCPT ); Thu, 9 Nov 2017 19:21:39 -0500 Received: from gateway22.websitewelcome.com ([192.185.47.79]:21563 "EHLO gateway22.websitewelcome.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754502AbdKJAVi (ORCPT ); Thu, 9 Nov 2017 19:21:38 -0500 Date: Thu, 9 Nov 2017 18:21:34 -0600 From: "Gustavo A. R. Silva" To: Andrey Konovalov , Mauro Carvalho Chehab , Hans Verkuil , Sean Young , linux-media@vger.kernel.org, Andi Shyti , LKML Cc: Dmitry Vyukov , Kostya Serebryany , syzkaller , "Gustavo A. R. Silva" Subject: [PATCH] au0828: fix use-after-free at USB probing Message-ID: <20171110002134.GA32019@embeddedor.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.5.24 (2015-08-30) X-AntiAbuse: This header was added to track abuse, please include it with any abuse report X-AntiAbuse: Primary Hostname - gator4166.hostgator.com X-AntiAbuse: Original Domain - vger.kernel.org X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12] X-AntiAbuse: Sender Address Domain - embeddedor.com X-BWhitelist: no X-Source-IP: 189.175.7.72 X-Source-L: No X-Exim-ID: 1eCx4j-001lWc-4t X-Source: X-Source-Args: X-Source-Dir: X-Source-Sender: (embeddedor) [189.175.7.72]:33450 X-Source-Auth: garsilva@embeddedor.com X-Email-Count: 7 X-Source-Cap: Z3V6aWRpbmU7Z3V6aWRpbmU7Z2F0b3I0MTY2Lmhvc3RnYXRvci5jb20= X-Local-Domain: yes Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Hi Andrey, Could you please try this patch? Thank you The device is typically freed on failure after trying to set USB interface0 to as5 in function au0828_analog_register. Fix use-after-free by returning the error value inmediately after failure, instead of jumping to au0828_usb_disconnect where _dev_ is also freed. Signed-off-by: Gustavo A. R. Silva --- drivers/media/usb/au0828/au0828-core.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/drivers/media/usb/au0828/au0828-core.c b/drivers/media/usb/au0828/au0828-core.c index cd363a2..b4abd90 100644 --- a/drivers/media/usb/au0828/au0828-core.c +++ b/drivers/media/usb/au0828/au0828-core.c @@ -630,7 +630,7 @@ static int au0828_usb_probe(struct usb_interface *interface, __func__); mutex_unlock(&dev->lock); kfree(dev); - goto done; + return retval; } /* Digital TV */ @@ -655,7 +655,6 @@ static int au0828_usb_probe(struct usb_interface *interface, retval = au0828_media_device_register(dev, usbdev); -done: if (retval < 0) au0828_usb_disconnect(interface); -- 2.7.4