Stable Archive on
 help / color / Atom feed
* [git:media_tree/master] media: usbvision: Fix invalid accesses after device disconnect
@ 2019-10-10 10:22 Mauro Carvalho Chehab
  0 siblings, 0 replies; only message in thread
From: Mauro Carvalho Chehab @ 2019-10-10 10:22 UTC (permalink / raw)
  To: linuxtv-commits
  Cc: Hans Verkuil, syzbot+7fa38a608b1075dfd634, Alan Stern, stable

This is an automatic generated email to let you know that the following patch were queued:

Subject: media: usbvision: Fix invalid accesses after device disconnect
Author:  Alan Stern <>
Date:    Mon Oct 7 12:09:04 2019 -0300

The syzbot fuzzer found two invalid-access bugs in the usbvision
driver.  These bugs occur when userspace keeps the device file open
after the device has been disconnected and usbvision_disconnect() has
set usbvision->dev to NULL:

	When the device file is closed, usbvision_radio_close() tries
	to issue a usb_set_interface() call, passing the NULL pointer
	as its first argument.

	If userspace performs a querycap ioctl call, vidioc_querycap()
	calls usb_make_path() with the same NULL pointer.

This patch fixes the problems by making the appropriate tests
beforehand.  Note that vidioc_querycap() is protected by
usbvision->v4l2_lock, acquired in a higher layer of the V4L2


Signed-off-by: Alan Stern <>
CC: <>
Signed-off-by: Hans Verkuil <>
Signed-off-by: Mauro Carvalho Chehab <>

 drivers/media/usb/usbvision/usbvision-video.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)


diff --git a/drivers/media/usb/usbvision/usbvision-video.c b/drivers/media/usb/usbvision/usbvision-video.c
index cdc66adda755..62dec73aec6e 100644
--- a/drivers/media/usb/usbvision/usbvision-video.c
+++ b/drivers/media/usb/usbvision/usbvision-video.c
@@ -453,6 +453,9 @@ static int vidioc_querycap(struct file *file, void  *priv,
 	struct usb_usbvision *usbvision = video_drvdata(file);
+	if (!usbvision->dev)
+		return -ENODEV;
 	strscpy(vc->driver, "USBVision", sizeof(vc->driver));
@@ -1099,8 +1102,9 @@ static int usbvision_radio_close(struct file *file)
 	/* Set packet size to 0 */
 	usbvision->iface_alt = 0;
-	usb_set_interface(usbvision->dev, usbvision->iface,
-				    usbvision->iface_alt);
+	if (usbvision->dev)
+		usb_set_interface(usbvision->dev, usbvision->iface,
+				  usbvision->iface_alt);
 	usbvision->radio = 0;

^ permalink raw reply	[flat|nested] only message in thread

only message in thread, back to index

Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-10-10 10:22 [git:media_tree/master] media: usbvision: Fix invalid accesses after device disconnect Mauro Carvalho Chehab

Stable Archive on

Archives are clonable:
	git clone --mirror stable/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 stable stable/ \
	public-inbox-index stable

Example config snippet for mirrors

Newsgroup available over NNTP:

AGPL code for this site: git clone public-inbox