Commit a26efd19 authored by Dinghao Liu's avatar Dinghao Liu Committed by Mauro Carvalho Chehab
Browse files

media: em28xx: Fix use-after-free in em28xx_alloc_urbs 



When kzalloc() fails, em28xx_uninit_usb_xfer() will free
usb_bufs->buf and set it to NULL. Thus the later access
to usb_bufs->buf[i] will lead to null pointer dereference.
Also the kfree(usb_bufs->buf) after that is redundant.

Fixes: d571b592 ("media: em28xx: don't use coherent buffer for DMA transfers")
Signed-off-by: default avatarDinghao Liu <dinghao.liu@zju.edu.cn>
Signed-off-by: default avatarHans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: default avatarMauro Carvalho Chehab <mchehab+huawei@kernel.org>
parent dbfa04ec

drivers/media/usb/em28xx/em28xx-core.c

+1 −5
Original line number Diff line number Diff line
@@ -956,14 +956,10 @@ int em28xx_alloc_urbs(struct em28xx *dev, enum em28xx_mode mode, int xfer_bulk, 


		usb_bufs->buf[i] = kzalloc(sb_size, GFP_KERNEL);

		if (!usb_bufs->buf[i]) {

			em28xx_uninit_usb_xfer(dev, mode);



			for (i--; i >= 0; i--)

				kfree(usb_bufs->buf[i]);



			kfree(usb_bufs->buf);

			usb_bufs->buf = NULL;



			em28xx_uninit_usb_xfer(dev, mode);

			return -ENOMEM;

		}