]> git.baikalelectronics.ru Git - kernel.git/commit
media: em28xx: add missing em28xx_close_extension
authorPavel Skripkin <paskripkin@gmail.com>
Thu, 29 Jul 2021 20:23:33 +0000 (22:23 +0200)
committerMauro Carvalho Chehab <mchehab+huawei@kernel.org>
Thu, 30 Sep 2021 08:07:38 +0000 (10:07 +0200)
commit1f944b38e74650573dab38a2cc46a89cbc95bdd3
tree566d6ac69fe8fbed47fc78587ae564240605ee54
parentdf297b38b5b9dc6bdd441ae4be8c7730ba3fa9a4
media: em28xx: add missing em28xx_close_extension

If em28xx dev has ->dev_next pointer, we need to delete ->dev_next list
node from em28xx_extension_devlist on disconnect to avoid UAF bugs and
corrupted list bugs, since driver frees this pointer on disconnect.

Reported-and-tested-by: syzbot+a6969ef522a36d3344c9@syzkaller.appspotmail.com
Fixes: 0a352d0999aa ("V4L/DVB (9979): em28xx: move usb probe code to a proper place")
Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
drivers/media/usb/em28xx/em28xx-cards.c