7d21e0b1b4
syzbot reported use-after-free in si470x_int_in_callback() [1]. This
indicates that urb->context, which contains struct si470x_device
object, is freed when si470x_int_in_callback() is called.
The cause of this issue is that si470x_int_in_callback() is called for
freed urb.
si470x_usb_driver_probe() calls si470x_start_usb(), which then calls
usb_submit_urb() and si470x_start(). If si470x_start_usb() fails,
si470x_usb_driver_probe() doesn't kill urb, but it just frees struct
si470x_device object, as depicted below:
si470x_usb_driver_probe()
...
si470x_start_usb()
...
usb_submit_urb()
retval = si470x_start()
return retval
if (retval < 0)
free struct si470x_device object, but don't kill urb
This patch fixes this issue by killing urb when si470x_start_usb()
fails and urb is submitted. If si470x_start_usb() fails and urb is
not submitted, i.e. submitting usb fails, it just frees struct
si470x_device object.
Reported-by: syzbot+9ca7a12fd736d93e0232@syzkaller.appspotmail.com
Link: https://syzkaller.appspot.com/bug?id=94ed6dddd5a55e90fd4bab942aa4bb297741d977 [1]
Signed-off-by: Shigeru Yoshida <syoshida@redhat.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
|
||
|---|---|---|
| .. | ||
| si470x | ||
| si4713 | ||
| wl128x | ||
| Kconfig | ||
| Makefile | ||
| dsbr100.c | ||
| lm7000.h | ||
| radio-aimslab.c | ||
| radio-aztech.c | ||
| radio-cadet.c | ||
| radio-gemtek.c | ||
| radio-isa.c | ||
| radio-isa.h | ||
| radio-keene.c | ||
| radio-ma901.c | ||
| radio-maxiradio.c | ||
| radio-miropcm20.c | ||
| radio-mr800.c | ||
| radio-raremono.c | ||
| radio-rtrack2.c | ||
| radio-sf16fmi.c | ||
| radio-sf16fmr2.c | ||
| radio-shark.c | ||
| radio-shark2.c | ||
| radio-si476x.c | ||
| radio-tea5764.c | ||
| radio-tea5777.c | ||
| radio-tea5777.h | ||
| radio-terratec.c | ||
| radio-timb.c | ||
| radio-trust.c | ||
| radio-typhoon.c | ||
| radio-wl1273.c | ||
| radio-zoltrix.c | ||
| saa7706h.c | ||
| tea575x.c | ||
| tef6862.c | ||