Skip to content
Commit aa93d1fe authored by James Patrick-Evans's avatar James Patrick-Evans Committed by Linus Torvalds
Browse files

media: fix airspy usb probe error path



Fix a memory leak on probe error of the airspy usb device driver.

The problem is triggered when more than 64 usb devices register with
v4l2 of type VFL_TYPE_SDR or VFL_TYPE_SUBDEV.

The memory leak is caused by the probe function of the airspy driver
mishandeling errors and not freeing the corresponding control structures
when an error occours registering the device to v4l2 core.

A badusb device can emulate 64 of these devices, and then through
continual emulated connect/disconnect of the 65th device, cause the
kernel to run out of RAM and crash the kernel, thus causing a local DOS
vulnerability.

Fixes CVE-2016-5400

Signed-off-by: default avatarJames Patrick-Evans <james@jmp-e.com>
Reviewed-by: default avatarKees Cook <keescook@chromium.org>
Cc: stable@vger.kernel.org # 3.17+
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent 0ba169ac
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment