From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from www.linuxtv.org ([130.149.80.248]:56218 "EHLO www.linuxtv.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750996AbcGOQdt (ORCPT ); Fri, 15 Jul 2016 12:33:49 -0400 From: Mauro Carvalho Chehab Date: Fri, 15 Jul 2016 16:32:21 +0000 Subject: [git:media_tree/master] [media] airspy: fix error logic during device register To: linuxtv-commits@linuxtv.org Cc: James Patrick-Evans , stable@vger.kernel.org Reply-to: linux-media@vger.kernel.org Message-Id: Sender: stable-owner@vger.kernel.org List-ID: This is an automatic generated email to let you know that the following patch were queued: Subject: [media] airspy: fix error logic during device register Author: James Patrick-Evans Date: Fri Jul 15 12:40:45 2016 -0300 This patch addresses CVE-2016-5400, a local DOS vulnerability caused by a memory leak in the airspy usb device driver. The vulnerability is triggered when more than 64 usb devices register with v4l2 of type VFL_TYPE_SDR or VFL_TYPE_SUBDEV.A badusb device can emulate 64 of these devices then through continual emulated connect/disconnect of the 65th device, cause the kernel to run out of RAM and crash the kernel. The vulnerability exists in kernel versions from 3.17 to current 4.7. The memory leak is caused by the probe function of the airspy driver mishandeling errors and not freeing the corresponding control structures when an error occours registering the device to v4l2 core. Signed-off-by: James Patrick-Evans Cc: stable@vger.kernel.org # Up to Kernel 3.17 Signed-off-by: Mauro Carvalho Chehab drivers/media/usb/airspy/airspy.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- diff --git a/drivers/media/usb/airspy/airspy.c b/drivers/media/usb/airspy/airspy.c index d807d5875f7e..19cd64c95bb8 100644 --- a/drivers/media/usb/airspy/airspy.c +++ b/drivers/media/usb/airspy/airspy.c @@ -1072,7 +1072,7 @@ static int airspy_probe(struct usb_interface *intf, if (ret) { dev_err(s->dev, "Failed to register as video device (%d)\n", ret); - goto err_unregister_v4l2_dev; + goto err_free_controls; } dev_info(s->dev, "Registered as %s\n", video_device_node_name(&s->vdev));