lkml.org 
[lkml]   [2019]   [Sep]   [17]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    SubjectRe: general protection fault in usb_set_interface
    On Mon, 16 Sep 2019, syzbot wrote:

    > Hello,
    >
    > syzbot has tested the proposed patch but the reproducer still triggered
    > crash:
    > general protection fault in vidioc_querycap

    Same problem in a different part of the code.

    Alan Stern

    #syz test: https://github.com/google/kasan.git f0df5c1b

    drivers/media/usb/usbvision/usbvision-video.c | 10 +++++++++-
    1 file changed, 9 insertions(+), 1 deletion(-)

    Index: usb-devel/drivers/media/usb/usbvision/usbvision-video.c
    ===================================================================
    --- usb-devel.orig/drivers/media/usb/usbvision/usbvision-video.c
    +++ usb-devel/drivers/media/usb/usbvision/usbvision-video.c
    @@ -453,6 +453,12 @@ static int vidioc_querycap(struct file *
    {
    struct usb_usbvision *usbvision = video_drvdata(file);

    + mutex_lock(&usbvision->v4l2_lock);
    + if (!usbvision->dev) {
    + mutex_unlock(&usbvision->v4l2_lock);
    + return -ENODEV;
    + }
    +
    strscpy(vc->driver, "USBVision", sizeof(vc->driver));
    strscpy(vc->card,
    usbvision_device_data[usbvision->dev_model].model_string,
    @@ -464,6 +470,7 @@ static int vidioc_querycap(struct file *
    vc->capabilities |= V4L2_CAP_RADIO;
    if (usbvision->have_tuner)
    vc->capabilities |= V4L2_CAP_TUNER;
    + mutex_unlock(&usbvision->v4l2_lock);
    return 0;
    }

    @@ -1111,7 +1118,8 @@ static int usbvision_radio_close(struct
    mutex_lock(&usbvision->v4l2_lock);
    /* Set packet size to 0 */
    usbvision->iface_alt = 0;
    - usb_set_interface(usbvision->dev, usbvision->iface,
    + if (usbvision->dev)
    + usb_set_interface(usbvision->dev, usbvision->iface,
    usbvision->iface_alt);

    usbvision_audio_off(usbvision);

    \
     
     \ /
      Last update: 2019-09-17 17:17    [W:2.941 / U:0.004 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site