This is a note to let you know that I've just added the patch titled
media: rc: iguanair: handle timeouts
to the 5.15-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
media-rc-iguanair-handle-timeouts.patch
and it can be found in the queue-5.15 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
commit 3c7d5b18b0d9c19e2be4187e2de4653f125ecb86
Author: Oliver Neukum <oneukum@xxxxxxxx>
Date: Tue Nov 26 14:17:22 2024 +0100
media: rc: iguanair: handle timeouts
[ Upstream commit b98d5000c50544f14bacb248c34e5219fbe81287 ]
In case of a timeout the IO must be cancelled or
the next IO using the URB will fail and/or overwrite
an operational URB.
The automatic bisection fails because it arrives
at a commit that correctly lets the test case run
without an error.
Signed-off-by: Oliver Neukum <oneukum@xxxxxxxx>
Fixes: e99a7cfe93fd ("[media] iguanair: reuse existing urb callback for command responses")
Reported-by: syzbot+ffba8e636870dac0e0c0@xxxxxxxxxxxxxxxxxxxxxxxxx
Closes: https://lore.kernel.org/all/66f5cc9a.050a0220.46d20.0004.GAE@xxxxxxxxxx/
Tested-by: syzbot+ffba8e636870dac0e0c0@xxxxxxxxxxxxxxxxxxxxxxxxx
Signed-off-by: Sean Young <sean@xxxxxxxx>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@xxxxxxxxxx>
Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>
diff --git a/drivers/media/rc/iguanair.c b/drivers/media/rc/iguanair.c
index 84949baf9f6b3..c1343df0dbbab 100644
--- a/drivers/media/rc/iguanair.c
+++ b/drivers/media/rc/iguanair.c
@@ -197,8 +197,10 @@ static int iguanair_send(struct iguanair *ir, unsigned size)
if (rc)
return rc;
- if (wait_for_completion_timeout(&ir->completion, TIMEOUT) == 0)
+ if (wait_for_completion_timeout(&ir->completion, TIMEOUT) == 0) {
+ usb_kill_urb(ir->urb_out);
return -ETIMEDOUT;
+ }
return rc;
}
