Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit d44922ed authored by Hans Verkuil's avatar Hans Verkuil Committed by Greg Kroah-Hartman
Browse files

media: radio/si470x: kill urb on error 

[ Upstream commit 0d616f2a3fdbf1304db44d451d9f07008556923b ]

In the probe() function radio->int_in_urb was not killed if an
error occurred in the probe sequence. It was also missing in
the disconnect.

This caused this syzbot issue:

https://syzkaller.appspot.com/bug?extid=2d4fc2a0c45ad8da7e99



Reported-and-tested-by: default avatar <syzbot+2d4fc2a0c45ad8da7e99@syzkaller.appspotmail.com>

Signed-off-by: default avatarHans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: default avatarMauro Carvalho Chehab <mchehab+samsung@kernel.org>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
parent abee2154

drivers/media/radio/si470x/radio-si470x-usb.c

+4 −1
Original line number Diff line number Diff line
@@ -742,7 +742,7 @@ static int si470x_usb_driver_probe(struct usb_interface *intf, 
	/* start radio */

	retval = si470x_start_usb(radio);

	if (retval < 0)

		goto err_all;

		goto err_buf;



	/* set initial frequency */

	si470x_set_freq(radio, 87.5 * FREQ_MUL); /* available in all regions */
@@ -757,6 +757,8 @@ static int si470x_usb_driver_probe(struct usb_interface *intf, 


	return 0;

err_all:

	usb_kill_urb(radio->int_in_urb);

err_buf:

	kfree(radio->buffer);

err_ctrl:

	v4l2_ctrl_handler_free(&radio->hdl);
@@ -830,6 +832,7 @@ static void si470x_usb_driver_disconnect(struct usb_interface *intf) 
	mutex_lock(&radio->lock);

	v4l2_device_disconnect(&radio->v4l2_dev);

	video_unregister_device(&radio->videodev);

	usb_kill_urb(radio->int_in_urb);

	usb_set_intfdata(intf, NULL);

	mutex_unlock(&radio->lock);

	v4l2_device_put(&radio->v4l2_dev);