mirrors/linux-stable
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2024-09-14 06:35:12 +00:00
Code Issues Releases Wiki Activity

media: em28xx: Fix use-after-free in em28xx_alloc_urbs

Browse source 
When kzalloc() fails, em28xx_uninit_usb_xfer() will free
usb_bufs->buf and set it to NULL. Thus the later access
to usb_bufs->buf[i] will lead to null pointer dereference.
Also the kfree(usb_bufs->buf) after that is redundant.

Fixes: d571b592c6 ("media: em28xx: don't use coherent buffer for DMA transfers")
Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
This commit is contained in:
Dinghao Liu 2020-12-28 14:02:05 +01:00 committed by Mauro Carvalho Chehab
parent dbfa04ec61
commit a26efd1961
1 changed files with 1 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
drivers/media/usb/em28xx/em28xx-core.c
View file

@ -956,14 +956,10 @@ int em28xx_alloc_urbs(struct em28xx *dev, enum em28xx_mode mode, int xfer_bulk,
usb_bufs->buf[i] = kzalloc(sb_size, GFP_KERNEL);
if (!usb_bufs->buf[i]) {
em28xx_uninit_usb_xfer(dev, mode);
for (i--; i >= 0; i--)
kfree(usb_bufs->buf[i]);
kfree(usb_bufs->buf);
usb_bufs->buf = NULL;
em28xx_uninit_usb_xfer(dev, mode);
return -ENOMEM;
}