mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-08-28 20:02:17 +00:00
media: radio/si470x: kill urb on error
In the probe() function radio->int_in_urb was not killed if an error occurred in the probe sequence. It was also missing in the disconnect. This caused this syzbot issue: https://syzkaller.appspot.com/bug?extid=2d4fc2a0c45ad8da7e99 Reported-and-tested-by: syzbot+2d4fc2a0c45ad8da7e99@syzkaller.appspotmail.com Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
This commit is contained in:
parent
3cec570b6d
commit
0d616f2a3f
1 changed files with 4 additions and 1 deletions
|
@ -734,7 +734,7 @@ static int si470x_usb_driver_probe(struct usb_interface *intf,
|
|||
/* start radio */
|
||||
retval = si470x_start_usb(radio);
|
||||
if (retval < 0)
|
||||
goto err_all;
|
||||
goto err_buf;
|
||||
|
||||
/* set initial frequency */
|
||||
si470x_set_freq(radio, 87.5 * FREQ_MUL); /* available in all regions */
|
||||
|
@ -749,6 +749,8 @@ static int si470x_usb_driver_probe(struct usb_interface *intf,
|
|||
|
||||
return 0;
|
||||
err_all:
|
||||
usb_kill_urb(radio->int_in_urb);
|
||||
err_buf:
|
||||
kfree(radio->buffer);
|
||||
err_ctrl:
|
||||
v4l2_ctrl_handler_free(&radio->hdl);
|
||||
|
@ -822,6 +824,7 @@ static void si470x_usb_driver_disconnect(struct usb_interface *intf)
|
|||
mutex_lock(&radio->lock);
|
||||
v4l2_device_disconnect(&radio->v4l2_dev);
|
||||
video_unregister_device(&radio->videodev);
|
||||
usb_kill_urb(radio->int_in_urb);
|
||||
usb_set_intfdata(intf, NULL);
|
||||
mutex_unlock(&radio->lock);
|
||||
v4l2_device_put(&radio->v4l2_dev);
|
||||
|
|
Loading…
Reference in a new issue