diff options
| author | Hans Verkuil <hverkuil-cisco@xs4all.nl> | 2019-08-15 09:40:52 -0300 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2019-10-05 13:13:42 +0200 |
| commit | ea9b3fba2de54636cb0294e36b1c66d3b8d83d6c (patch) | |
| tree | 4d66d0b3ed1ad45b2e95ad212e450e3200edea78 /drivers/media | |
| parent | abec08cc8afdade0b84e97deaf4d4478b760b3a7 (diff) | |
| download | linux-stable-ea9b3fba2de54636cb0294e36b1c66d3b8d83d6c.tar.gz linux-stable-ea9b3fba2de54636cb0294e36b1c66d3b8d83d6c.tar.bz2 linux-stable-ea9b3fba2de54636cb0294e36b1c66d3b8d83d6c.zip | |
media: radio/si470x: kill urb on error
[ Upstream commit 0d616f2a3fdbf1304db44d451d9f07008556923b ]
In the probe() function radio->int_in_urb was not killed if an
error occurred in the probe sequence. It was also missing in
the disconnect.
This caused this syzbot issue:
https://syzkaller.appspot.com/bug?extid=2d4fc2a0c45ad8da7e99
Reported-and-tested-by: syzbot+2d4fc2a0c45ad8da7e99@syzkaller.appspotmail.com
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Diffstat (limited to 'drivers/media')
| -rw-r--r-- | drivers/media/radio/si470x/radio-si470x-usb.c | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/drivers/media/radio/si470x/radio-si470x-usb.c b/drivers/media/radio/si470x/radio-si470x-usb.c index 58e622d57373..3dccce398113 100644 --- a/drivers/media/radio/si470x/radio-si470x-usb.c +++ b/drivers/media/radio/si470x/radio-si470x-usb.c @@ -734,7 +734,7 @@ static int si470x_usb_driver_probe(struct usb_interface *intf, /* start radio */ retval = si470x_start_usb(radio); if (retval < 0) - goto err_all; + goto err_buf; /* set initial frequency */ si470x_set_freq(radio, 87.5 * FREQ_MUL); /* available in all regions */ @@ -749,6 +749,8 @@ static int si470x_usb_driver_probe(struct usb_interface *intf, return 0; err_all: + usb_kill_urb(radio->int_in_urb); +err_buf: kfree(radio->buffer); err_ctrl: v4l2_ctrl_handler_free(&radio->hdl); @@ -822,6 +824,7 @@ static void si470x_usb_driver_disconnect(struct usb_interface *intf) mutex_lock(&radio->lock); v4l2_device_disconnect(&radio->v4l2_dev); video_unregister_device(&radio->videodev); + usb_kill_urb(radio->int_in_urb); usb_set_intfdata(intf, NULL); mutex_unlock(&radio->lock); v4l2_device_put(&radio->v4l2_dev); |