media: radio/si470x: kill urb on error (0d616f2a) · Commits · 戴 / test

In the probe() function radio->int_in_urb was not killed if an error occurred in the probe sequence. It was also missing in the disconnect. This caused this syzbot issue: https://syzkaller.appspot.com/bug?extid=2d4fc2a0c45ad8da7e99 Reported-and-tested-by:

<syzbot+2d4fc2a0c45ad8da7e99@syzkaller.appspotmail.com> Signed-off-by:

Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by:

Mauro Carvalho Chehab <mchehab+samsung@kernel.org>

drivers/media/radio/si470x/radio-si470x-usb.c

+4 −1

Original line number	Diff line number	Diff line
		@@ -734,7 +734,7 @@ static int si470x_usb_driver_probe(struct usb_interface *intf,
		/* start radio */
		retval = si470x_start_usb(radio);
		if (retval < 0)
		goto err_all;
		goto err_buf;

		/* set initial frequency */
		si470x_set_freq(radio, 87.5 * FREQ_MUL); /* available in all regions */
		@@ -749,6 +749,8 @@ static int si470x_usb_driver_probe(struct usb_interface *intf,

		return 0;
		err_all:
		usb_kill_urb(radio->int_in_urb);
		err_buf:
		kfree(radio->buffer);
		err_ctrl:
		v4l2_ctrl_handler_free(&radio->hdl);
		@@ -822,6 +824,7 @@ static void si470x_usb_driver_disconnect(struct usb_interface *intf)
		mutex_lock(&radio->lock);
		v4l2_device_disconnect(&radio->v4l2_dev);
		video_unregister_device(&radio->videodev);
		usb_kill_urb(radio->int_in_urb);
		usb_set_intfdata(intf, NULL);
		mutex_unlock(&radio->lock);
		v4l2_device_put(&radio->v4l2_dev);

Admin message