[lkml]   [2020]   [Feb]   [8]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
Patch in this message
Subject[PATCH 3.16 025/148] media: usbvision: Fix invalid accesses after device disconnect
3.16.82-rc1 review patch.  If anyone has any objections, please let me know.


From: Alan Stern <>

commit c7a191464078262bf799136317c95824e26a222b upstream.

The syzbot fuzzer found two invalid-access bugs in the usbvision
driver. These bugs occur when userspace keeps the device file open
after the device has been disconnected and usbvision_disconnect() has
set usbvision->dev to NULL:

When the device file is closed, usbvision_radio_close() tries
to issue a usb_set_interface() call, passing the NULL pointer
as its first argument.

If userspace performs a querycap ioctl call, vidioc_querycap()
calls usb_make_path() with the same NULL pointer.

This patch fixes the problems by making the appropriate tests
beforehand. Note that vidioc_querycap() is protected by
usbvision->v4l2_lock, acquired in a higher layer of the V4L2


Signed-off-by: Alan Stern <>
Signed-off-by: Hans Verkuil <>
Signed-off-by: Mauro Carvalho Chehab <>
[bwh: Backported to 3.16: adjust context]
Signed-off-by: Ben Hutchings <>
drivers/media/usb/usbvision/usbvision-video.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)

--- a/drivers/media/usb/usbvision/usbvision-video.c
+++ b/drivers/media/usb/usbvision/usbvision-video.c
@@ -482,6 +482,9 @@ static int vidioc_querycap(struct file *
struct usb_usbvision *usbvision = video_drvdata(file);

+ if (!usbvision->dev)
+ return -ENODEV;
strlcpy(vc->driver, "USBVision", sizeof(vc->driver));
@@ -1169,8 +1172,9 @@ static int usbvision_radio_close(struct
/* Set packet size to 0 */
usbvision->iface_alt = 0;
- err_code = usb_set_interface(usbvision->dev, usbvision->iface,
- usbvision->iface_alt);
+ if (usbvision->dev)
+ err_code = usb_set_interface(usbvision->dev, usbvision->iface,
+ usbvision->iface_alt);

usbvision->radio = 0;
 \ /
  Last update: 2020-02-08 19:39    [W:0.344 / U:0.176 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site