AuxXxilium/linux_dsm_epyc7002
1
0
Fork 0
mirror of https://github.com/AuxXxilium/linux_dsm_epyc7002.git synced 2025-02-20 15:06:39 +07:00
Code Issues Actions Packages Projects Releases Wiki Activity

media: em28xx: Fix use-after-free in em28xx_alloc_urbs

Browse Source 
[ Upstream commit a26efd1961a18b91ae4cd2e433adbcf865b40fa3 ]

When kzalloc() fails, em28xx_uninit_usb_xfer() will free
usb_bufs->buf and set it to NULL. Thus the later access
to usb_bufs->buf[i] will lead to null pointer dereference.
Also the kfree(usb_bufs->buf) after that is redundant.

Fixes: d571b592c6 ("media: em28xx: don't use coherent buffer for DMA transfers")
Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
Dinghao Liu 2020-12-28 14:02:05 +01:00 committed by Greg Kroah-Hartman
parent 27dfb2c856
commit 451c7cb236
1 changed files with 1 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
drivers/media/usb/em28xx/em28xx-core.c
View File

@ -956,14 +956,10 @@ int em28xx_alloc_urbs(struct em28xx *dev, enum em28xx_mode mode, int xfer_bulk,
usb_bufs->buf[i] = kzalloc(sb_size, GFP_KERNEL);
if (!usb_bufs->buf[i]) {
em28xx_uninit_usb_xfer(dev, mode);
for (i--; i >= 0; i--)
kfree(usb_bufs->buf[i]);
kfree(usb_bufs->buf);
usb_bufs->buf = NULL;
em28xx_uninit_usb_xfer(dev, mode);
return -ENOMEM;
}