Commit 8b44cc22 authored May 09, 2019 by Oliver Neukum Committed by Greg Kroah-Hartman Aug 04, 2019

media: cpia2_usb: first wake up, then free in disconnect



commit eff73de2b1600ad8230692f00bc0ab49b166512a upstream.

Kasan reported a use after free in cpia2_usb_disconnect()
It first freed everything and then woke up those waiting.
The reverse order is correct.

Fixes: 6c493f8b ("[media] cpia2: major overhaul to get it in a working state again")

Signed-off-by: Oliver Neukum <oneukum@suse.com>
Reported-by:  <syzbot+0c90fc937c84f97d0aa6@syzkaller.appspotmail.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

parent 693019ee

drivers/media/usb/cpia2/cpia2_usb.c

+2 −1

Original line number	Diff line number	Diff line
		@@ -902,7 +902,6 @@ static void cpia2_usb_disconnect(struct usb_interface *intf)
		cpia2_unregister_camera(cam);
		v4l2_device_disconnect(&cam->v4l2_dev);
		mutex_unlock(&cam->v4l2_lock);
		v4l2_device_put(&cam->v4l2_dev);

		if(cam->buffers) {
		DBG("Wakeup waiting processes\n");
		@@ -911,6 +910,8 @@ static void cpia2_usb_disconnect(struct usb_interface *intf)
		wake_up_interruptible(&cam->wq_stream);
		}

		v4l2_device_put(&cam->v4l2_dev);

		LOG("CPiA2 camera disconnected.\n");
		}