averello/linux-stable-mirror
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2026-04-24 10:49:54 +02:00
Code Issues Packages Projects Releases Wiki Activity

media: pvrusb2: fix URB leak in pvr2_send_request_ex

Browse Source 
When pvr2_send_request_ex() submits a write URB successfully but fails to
submit the read URB (e.g. returns -ENOMEM), it returns immediately without
waiting for the write URB to complete. Since the driver reuses the same
URB structure, a subsequent call to pvr2_send_request_ex() attempts to
submit the still-active write URB, triggering a 'URB submitted while
active' warning in usb_submit_urb().

Fix this by ensuring the write URB is unlinked and waited upon if the read
URB submission fails.

Reported-by: syzbot+405dcd13121ff75a9e16@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=405dcd13121ff75a9e16
Signed-off-by: Szymon Wilczek <szymonwilczek@gmx.com>
Acked-by: Mike Isely <isely@pobox.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
This commit is contained in:
Szymon Wilczek
2025-12-20 19:24:19 +01:00
committed by Hans Verkuil
parent 63bf2f7171
commit a8333c8262
1 changed files with 5 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
drivers/media/usb/pvrusb2/pvrusb2-hdw.c
+5
View File
@@ -3709,6 +3709,11 @@ status);
"Failed to submit read-control URB status=%d",
status);
hdw->ctl_read_pend_flag = 0;
if (hdw->ctl_write_pend_flag) {
usb_unlink_urb(hdw->ctl_write_urb);
while (hdw->ctl_write_pend_flag)
wait_for_completion(&hdw->ctl_done);
}
goto done;
}
}