Unverified Commit b60aa042 authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!1662 media: usb: siano: Fix CVE-2023-4132 

Merge Pull Request from: @ci-robot 
 
PR sync from: Ruan Jinjie <ruanjinjie@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/RUVYH7GZGYAK3FORCDR2XWXWJUTLLM2M/ 
Backport CVE-2023-4132 fix commits.

Duoming Zhou (2):
  media: usb: siano: Fix use after free bugs caused by do_submit_urb
  media: usb: siano: Fix warning due to null work_func_t function
    pointer


-- 
2.34.1
 
https://gitee.com/src-openeuler/kernel/issues/I7QE3A 
 
Link:https://gitee.com/openeuler/kernel/pulls/1662

 

Reviewed-by: default avatarLiu YongQiang <liuyongqiang13@huawei.com>
Signed-off-by: default avatarLiu YongQiang <liuyongqiang13@huawei.com>
parents 8d661f2f a1f80798

drivers/media/usb/siano/smsusb.c

+2 −0
Original line number Diff line number Diff line
@@ -190,6 +190,8 @@ static void smsusb_stop_streaming(struct smsusb_device_t *dev) 


	for (i = 0; i < MAX_URBS; i++) {

		usb_kill_urb(&dev->surbs[i].urb);

		if (dev->surbs[i].wq.func)

			cancel_work_sync(&dev->surbs[i].wq);



		if (dev->surbs[i].cb) {

			smscore_putbuffer(dev->coredev, dev->surbs[i].cb);