lkml.org 
[lkml]   [2019]   [Sep]   [22]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH AUTOSEL 4.19 061/128] media: radio/si470x: kill urb on error
    Date
    From: Hans Verkuil <hverkuil-cisco@xs4all.nl>

    [ Upstream commit 0d616f2a3fdbf1304db44d451d9f07008556923b ]

    In the probe() function radio->int_in_urb was not killed if an
    error occurred in the probe sequence. It was also missing in
    the disconnect.

    This caused this syzbot issue:

    https://syzkaller.appspot.com/bug?extid=2d4fc2a0c45ad8da7e99

    Reported-and-tested-by: syzbot+2d4fc2a0c45ad8da7e99@syzkaller.appspotmail.com

    Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
    Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/media/radio/si470x/radio-si470x-usb.c | 5 ++++-
    1 file changed, 4 insertions(+), 1 deletion(-)

    diff --git a/drivers/media/radio/si470x/radio-si470x-usb.c b/drivers/media/radio/si470x/radio-si470x-usb.c
    index 313a95f195a27..19e381dd58089 100644
    --- a/drivers/media/radio/si470x/radio-si470x-usb.c
    +++ b/drivers/media/radio/si470x/radio-si470x-usb.c
    @@ -743,7 +743,7 @@ static int si470x_usb_driver_probe(struct usb_interface *intf,
    /* start radio */
    retval = si470x_start_usb(radio);
    if (retval < 0)
    - goto err_all;
    + goto err_buf;

    /* set initial frequency */
    si470x_set_freq(radio, 87.5 * FREQ_MUL); /* available in all regions */
    @@ -758,6 +758,8 @@ static int si470x_usb_driver_probe(struct usb_interface *intf,

    return 0;
    err_all:
    + usb_kill_urb(radio->int_in_urb);
    +err_buf:
    kfree(radio->buffer);
    err_ctrl:
    v4l2_ctrl_handler_free(&radio->hdl);
    @@ -831,6 +833,7 @@ static void si470x_usb_driver_disconnect(struct usb_interface *intf)
    mutex_lock(&radio->lock);
    v4l2_device_disconnect(&radio->v4l2_dev);
    video_unregister_device(&radio->videodev);
    + usb_kill_urb(radio->int_in_urb);
    usb_set_intfdata(intf, NULL);
    mutex_unlock(&radio->lock);
    v4l2_device_put(&radio->v4l2_dev);
    --
    2.20.1
    \
     
     \ /
      Last update: 2019-09-22 21:20    [W:4.090 / U:0.024 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site