lkml.org 
[lkml]   [2016]   [Aug]   [8]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.4 59/68] media: fix airspy usb probe error path
    Date
    4.4-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: James Patrick-Evans <james@jmp-e.com>

    commit aa93d1fee85c890a34f2510a310e55ee76a27848 upstream.

    Fix a memory leak on probe error of the airspy usb device driver.

    The problem is triggered when more than 64 usb devices register with
    v4l2 of type VFL_TYPE_SDR or VFL_TYPE_SUBDEV.

    The memory leak is caused by the probe function of the airspy driver
    mishandeling errors and not freeing the corresponding control structures
    when an error occours registering the device to v4l2 core.

    A badusb device can emulate 64 of these devices, and then through
    continual emulated connect/disconnect of the 65th device, cause the
    kernel to run out of RAM and crash the kernel, thus causing a local DOS
    vulnerability.

    Fixes CVE-2016-5400

    Signed-off-by: James Patrick-Evans <james@jmp-e.com>
    Reviewed-by: Kees Cook <keescook@chromium.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    drivers/media/usb/airspy/airspy.c | 3 +--
    1 file changed, 1 insertion(+), 2 deletions(-)

    --- a/drivers/media/usb/airspy/airspy.c
    +++ b/drivers/media/usb/airspy/airspy.c
    @@ -1073,7 +1073,7 @@ static int airspy_probe(struct usb_inter
    if (ret) {
    dev_err(s->dev, "Failed to register as video device (%d)\n",
    ret);
    - goto err_unregister_v4l2_dev;
    + goto err_free_controls;
    }
    dev_info(s->dev, "Registered as %s\n",
    video_device_node_name(&s->vdev));
    @@ -1082,7 +1082,6 @@ static int airspy_probe(struct usb_inter

    err_free_controls:
    v4l2_ctrl_handler_free(&s->hdl);
    -err_unregister_v4l2_dev:
    v4l2_device_unregister(&s->v4l2_dev);
    err_free_mem:
    kfree(s);

    \
     
     \ /
      Last update: 2016-08-08 22:21    [W:3.484 / U:0.016 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site