public-mirrors/linux
1
0
Fork 0
mirror of git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2025-08-05 16:54:27 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

media: em28xx: Fix use-after-free in em28xx_alloc_urbs

Browse source 
When kzalloc() fails, em28xx_uninit_usb_xfer() will free
usb_bufs->buf and set it to NULL. Thus the later access
to usb_bufs->buf[i] will lead to null pointer dereference.
Also the kfree(usb_bufs->buf) after that is redundant.

Fixes: d571b592c6 ("media: em28xx: don't use coherent buffer for DMA transfers")
Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
This commit is contained in:
Dinghao Liu 2020-12-28 14:02:05 +01:00 • committed by Mauro Carvalho Chehab
parent dbfa04ec61
commit a26efd1961
1 changed files with 1 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
drivers/media/usb/em28xx/em28xx-core.c
View file

@ -956,14 +956,10 @@ int em28xx_alloc_urbs(struct em28xx *dev, enum em28xx_mode mode, int xfer_bulk,
usb_bufs->buf[i] = kzalloc(sb_size, GFP_KERNEL); usb_bufs->buf[i] = kzalloc(sb_size, GFP_KERNEL);
if (!usb_bufs->buf[i]) { if (!usb_bufs->buf[i]) {
em28xx_uninit_usb_xfer(dev, mode);
for (i--; i >= 0; i--) for (i--; i >= 0; i--)
kfree(usb_bufs->buf[i]); kfree(usb_bufs->buf[i]);
kfree(usb_bufs->buf); em28xx_uninit_usb_xfer(dev, mode);
usb_bufs->buf = NULL;
return -ENOMEM; return -ENOMEM;
} }