Unverified Commit d3907308 authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!1657 media: usb: siano: Fix CVE-2023-4132 

Merge Pull Request from: @ci-robot 
 
PR sync from: Ruan Jinjie <ruanjinjie@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/DMKZQARD2PWAP2YXIKY6D454ZNKTEVT3/ 
Backport CVE-2023-4132 fix commits.

Duoming Zhou (2):
  media: usb: siano: Fix use after free bugs caused by do_submit_urb
  media: usb: siano: Fix warning due to null work_func_t function
    pointer


-- 
2.34.1
 
https://gitee.com/openeuler/kernel/issues/I7QTMZ 
 
Link:https://gitee.com/openeuler/kernel/pulls/1657

 

Reviewed-by: default avatarJialin Zhang <zhangjialin11@huawei.com>
Signed-off-by: default avatarJialin Zhang <zhangjialin11@huawei.com>
parents 4e547f49 d6a3c21a

drivers/media/usb/siano/smsusb.c

+2 −0
Original line number Diff line number Diff line
@@ -179,6 +179,8 @@ static void smsusb_stop_streaming(struct smsusb_device_t *dev) 


	for (i = 0; i < MAX_URBS; i++) {

		usb_kill_urb(&dev->surbs[i].urb);

		if (dev->surbs[i].wq.func)

			cancel_work_sync(&dev->surbs[i].wq);



		if (dev->surbs[i].cb) {

			smscore_putbuffer(dev->coredev, dev->surbs[i].cb);