lkml.org 
[lkml]   [2021]   [Mar]   [1]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.10 166/663] media: em28xx: Fix use-after-free in em28xx_alloc_urbs
    Date
    From: Dinghao Liu <dinghao.liu@zju.edu.cn>

    [ Upstream commit a26efd1961a18b91ae4cd2e433adbcf865b40fa3 ]

    When kzalloc() fails, em28xx_uninit_usb_xfer() will free
    usb_bufs->buf and set it to NULL. Thus the later access
    to usb_bufs->buf[i] will lead to null pointer dereference.
    Also the kfree(usb_bufs->buf) after that is redundant.

    Fixes: d571b592c6206 ("media: em28xx: don't use coherent buffer for DMA transfers")
    Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn>
    Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
    Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/media/usb/em28xx/em28xx-core.c | 6 +-----
    1 file changed, 1 insertion(+), 5 deletions(-)

    diff --git a/drivers/media/usb/em28xx/em28xx-core.c b/drivers/media/usb/em28xx/em28xx-core.c
    index e6088b5d1b805..3daa64bb1e1d9 100644
    --- a/drivers/media/usb/em28xx/em28xx-core.c
    +++ b/drivers/media/usb/em28xx/em28xx-core.c
    @@ -956,14 +956,10 @@ int em28xx_alloc_urbs(struct em28xx *dev, enum em28xx_mode mode, int xfer_bulk,

    usb_bufs->buf[i] = kzalloc(sb_size, GFP_KERNEL);
    if (!usb_bufs->buf[i]) {
    - em28xx_uninit_usb_xfer(dev, mode);
    -
    for (i--; i >= 0; i--)
    kfree(usb_bufs->buf[i]);

    - kfree(usb_bufs->buf);
    - usb_bufs->buf = NULL;
    -
    + em28xx_uninit_usb_xfer(dev, mode);
    return -ENOMEM;
    }

    --
    2.27.0


    \
     
     \ /
      Last update: 2021-03-02 03:41    [W:3.552 / U:0.344 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site