]> git.baikalelectronics.ru Git - kernel.git/commit
media: em28xx: add missing em28xx_close_extension
authorPavel Skripkin <paskripkin@gmail.com>
Thu, 29 Jul 2021 20:23:33 +0000 (22:23 +0200)
committerMauro Carvalho Chehab <mchehab+huawei@kernel.org>
Thu, 30 Sep 2021 08:07:38 +0000 (10:07 +0200)
commit7ffcf4fbd3a12c57299e6a9f10c52fc6fb12a35d
tree566d6ac69fe8fbed47fc78587ae564240605ee54
parent6689c4ddf13181081a9efe26d8a23a99be6da4ab
media: em28xx: add missing em28xx_close_extension

If em28xx dev has ->dev_next pointer, we need to delete ->dev_next list
node from em28xx_extension_devlist on disconnect to avoid UAF bugs and
corrupted list bugs, since driver frees this pointer on disconnect.

Reported-and-tested-by: syzbot+a6969ef522a36d3344c9@syzkaller.appspotmail.com
Fixes: 0a352d0999aa ("V4L/DVB (9979): em28xx: move usb probe code to a proper place")
Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
drivers/media/usb/em28xx/em28xx-cards.c