diff options
| author | Dinghao Liu <dinghao.liu@zju.edu.cn> | 2020-12-28 14:02:05 +0100 |
|---|---|---|
| committer | Mauro Carvalho Chehab <mchehab+huawei@kernel.org> | 2021-01-12 18:21:07 +0100 |
| commit | a26efd1961a18b91ae4cd2e433adbcf865b40fa3 (patch) | |
| tree | 1975264fedb673db43796ec5867ff73bbcb2bfb0 /.gitignore | |
| parent | dbfa04ec61b7e68259efcdef39b1c637bfedf264 (diff) | |
media: em28xx: Fix use-after-free in em28xx_alloc_urbs
When kzalloc() fails, em28xx_uninit_usb_xfer() will free
usb_bufs->buf and set it to NULL. Thus the later access
to usb_bufs->buf[i] will lead to null pointer dereference.
Also the kfree(usb_bufs->buf) after that is redundant.
Fixes: d571b592c6206 ("media: em28xx: don't use coherent buffer for DMA transfers")
Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Diffstat (limited to '.gitignore')
0 files changed, 0 insertions, 0 deletions