media: usbvision: Fix invalid accesses after device disconnect
commit c7a1914640
upstream.
The syzbot fuzzer found two invalid-access bugs in the usbvision
driver. These bugs occur when userspace keeps the device file open
after the device has been disconnected and usbvision_disconnect() has
set usbvision->dev to NULL:
When the device file is closed, usbvision_radio_close() tries
to issue a usb_set_interface() call, passing the NULL pointer
as its first argument.
If userspace performs a querycap ioctl call, vidioc_querycap()
calls usb_make_path() with the same NULL pointer.
This patch fixes the problems by making the appropriate tests
beforehand. Note that vidioc_querycap() is protected by
usbvision->v4l2_lock, acquired in a higher layer of the V4L2
subsystem.
Reported-and-tested-by: syzbot+7fa38a608b1075dfd634@syzkaller.appspotmail.com
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
CC: <stable@vger.kernel.org>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
parent
5aa7ad7e99
commit
ddac4e3401
|
@ -453,6 +453,9 @@ static int vidioc_querycap(struct file *file, void *priv,
|
||||||
{
|
{
|
||||||
struct usb_usbvision *usbvision = video_drvdata(file);
|
struct usb_usbvision *usbvision = video_drvdata(file);
|
||||||
|
|
||||||
|
if (!usbvision->dev)
|
||||||
|
return -ENODEV;
|
||||||
|
|
||||||
strscpy(vc->driver, "USBVision", sizeof(vc->driver));
|
strscpy(vc->driver, "USBVision", sizeof(vc->driver));
|
||||||
strscpy(vc->card,
|
strscpy(vc->card,
|
||||||
usbvision_device_data[usbvision->dev_model].model_string,
|
usbvision_device_data[usbvision->dev_model].model_string,
|
||||||
|
@ -1099,8 +1102,9 @@ static int usbvision_radio_close(struct file *file)
|
||||||
mutex_lock(&usbvision->v4l2_lock);
|
mutex_lock(&usbvision->v4l2_lock);
|
||||||
/* Set packet size to 0 */
|
/* Set packet size to 0 */
|
||||||
usbvision->iface_alt = 0;
|
usbvision->iface_alt = 0;
|
||||||
usb_set_interface(usbvision->dev, usbvision->iface,
|
if (usbvision->dev)
|
||||||
usbvision->iface_alt);
|
usb_set_interface(usbvision->dev, usbvision->iface,
|
||||||
|
usbvision->iface_alt);
|
||||||
|
|
||||||
usbvision_audio_off(usbvision);
|
usbvision_audio_off(usbvision);
|
||||||
usbvision->radio = 0;
|
usbvision->radio = 0;
|
||||||
|
|
Loading…
Reference in New Issue