Patch "media: usb: siano: Fix warning due to null work_func_t function pointer" has been added to the 5.15-stable tree

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



This is a note to let you know that I've just added the patch titled

    media: usb: siano: Fix warning due to null work_func_t function pointer

to the 5.15-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     media-usb-siano-fix-warning-due-to-null-work_func_t-.patch
and it can be found in the queue-5.15 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit b75506b583796f373673241c5f4eae9bd6cbc91a
Author: Duoming Zhou <duoming@xxxxxxxxxx>
Date:   Tue May 23 07:59:32 2023 +0800

    media: usb: siano: Fix warning due to null work_func_t function pointer
    
    [ Upstream commit 6f489a966fbeb0da63d45c2c66a8957eab604bf6 ]
    
    The previous commit ebad8e731c1c ("media: usb: siano: Fix use after
    free bugs caused by do_submit_urb") adds cancel_work_sync() in
    smsusb_stop_streaming(). But smsusb_stop_streaming() may be called,
    even if the work_struct surb->wq has not been initialized. As a result,
    the warning will occur. One of the processes that could lead to warning
    is shown below:
    
    smsusb_probe()
      smsusb_init_device()
        if (!dev->in_ep || !dev->out_ep || align < 0) {
             smsusb_term_device(intf);
               smsusb_stop_streaming()
                 cancel_work_sync(&dev->surbs[i].wq);
                   __cancel_work_timer()
                     __flush_work()
                       if (WARN_ON(!work->func)) // work->func is null
    
    The log reported by syzbot is shown below:
    
    WARNING: CPU: 0 PID: 897 at kernel/workqueue.c:3066 __flush_work+0x798/0xa80 kernel/workqueue.c:3063
    Modules linked in:
    CPU: 0 PID: 897 Comm: kworker/0:2 Not tainted 6.2.0-rc1-syzkaller #0
    RIP: 0010:__flush_work+0x798/0xa80 kernel/workqueue.c:3066
    ...
    RSP: 0018:ffffc9000464ebf8 EFLAGS: 00010246
    RAX: 1ffff11002dbb420 RBX: 0000000000000021 RCX: 1ffffffff204fa4e
    RDX: dffffc0000000000 RSI: 0000000000000001 RDI: ffff888016dda0e8
    RBP: ffffc9000464ed98 R08: 0000000000000001 R09: ffffffff90253b2f
    R10: 0000000000000001 R11: 0000000000000000 R12: ffff888016dda0e8
    R13: ffff888016dda0e8 R14: ffff888016dda100 R15: 0000000000000001
    FS:  0000000000000000(0000) GS:ffff8880b9a00000(0000) knlGS:0000000000000000
    CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
    CR2: 00007ffd4331efe8 CR3: 000000000b48e000 CR4: 00000000003506f0
    DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
    DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
    Call Trace:
     <TASK>
     __cancel_work_timer+0x315/0x460 kernel/workqueue.c:3160
     smsusb_stop_streaming drivers/media/usb/siano/smsusb.c:182 [inline]
     smsusb_term_device+0xda/0x2d0 drivers/media/usb/siano/smsusb.c:344
     smsusb_init_device+0x400/0x9ce drivers/media/usb/siano/smsusb.c:419
     smsusb_probe+0xbbd/0xc55 drivers/media/usb/siano/smsusb.c:567
    ...
    
    This patch adds check before cancel_work_sync(). If surb->wq has not
    been initialized, the cancel_work_sync() will not be executed.
    
    Reported-by: syzbot+27b0b464864741b18b99@xxxxxxxxxxxxxxxxxxxxxxxxx
    Fixes: ebad8e731c1c ("media: usb: siano: Fix use after free bugs caused by do_submit_urb")
    Signed-off-by: Duoming Zhou <duoming@xxxxxxxxxx>
    Signed-off-by: Hans Verkuil <hverkuil-cisco@xxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/media/usb/siano/smsusb.c b/drivers/media/usb/siano/smsusb.c
index 1babfe6e2c361..5c223b5498b4b 100644
--- a/drivers/media/usb/siano/smsusb.c
+++ b/drivers/media/usb/siano/smsusb.c
@@ -179,7 +179,8 @@ static void smsusb_stop_streaming(struct smsusb_device_t *dev)
 
 	for (i = 0; i < MAX_URBS; i++) {
 		usb_kill_urb(&dev->surbs[i].urb);
-		cancel_work_sync(&dev->surbs[i].wq);
+		if (dev->surbs[i].wq.func)
+			cancel_work_sync(&dev->surbs[i].wq);
 
 		if (dev->surbs[i].cb) {
 			smscore_putbuffer(dev->coredev, dev->surbs[i].cb);



[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Index of Archives]     [Linux USB Devel]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]

  Powered by Linux