On Wed Sep 30 14:05:51 2026 +0530, Deepanshu Kartikey wrote:
> ictx->dev is a raw pointer to the usb_interface's embedded device.
> On disconnect, usb_disconnect() can drop the last reference on the
> interface and free it while a userspace fd for /dev/lcd0 is still
> open. When that fd is later closed, display_close() dereferences
> the now-freed ictx->dev via dev_dbg(), causing a use-after-free.
>
> Remove the dev_dbg() calls that dereference ictx->dev in
> display_close() and free_imon_context(), rather than taking a
> reference on the device.
>
> Fixes: 21677cfc562a ("V4L/DVB: ir-core: add imon driver")
> Cc: [email protected]
> Reported-by: [email protected]
> Closes: https://syzkaller.appspot.com/bug?extid=9bfac891bdd42eb708fc
> Link:
> https://lore.kernel.org/all/[email protected]/T/
> [v1]
> Link:
> https://lore.kernel.org/all/[email protected]/T/
> [v2]
> Signed-off-by: Deepanshu Kartikey <[email protected]>
> Signed-off-by: Sean Young <[email protected]>
Patch committed.
Thanks,
Sean Young
drivers/media/rc/imon.c | 5 -----
1 file changed, 5 deletions(-)
---
diff --git a/drivers/media/rc/imon.c b/drivers/media/rc/imon.c
index 2668461ed409..0a8844cce23b 100644
--- a/drivers/media/rc/imon.c
+++ b/drivers/media/rc/imon.c
@@ -491,16 +491,12 @@ MODULE_PARM_DESC(pad_thresh, "Threshold at which a pad
push registers as an arro
static void free_imon_context(struct imon_context *ictx)
{
- struct device *dev = ictx->dev;
-
usb_free_urb(ictx->tx_urb);
WARN_ON(ictx->dev_present_intf0);
usb_free_urb(ictx->rx_urb_intf0);
WARN_ON(ictx->dev_present_intf1);
usb_free_urb(ictx->rx_urb_intf1);
kfree_rcu(ictx, rcu);
-
- dev_dbg(dev, "%s: iMON context freed\n", __func__);
}
/*
@@ -576,7 +572,6 @@ static int display_close(struct inode *inode, struct file
*file)
retval = -EIO;
} else {
ictx->display_isopen = false;
- dev_dbg(ictx->dev, "display port closed\n");
}
mutex_unlock(&ictx->lock);
_______________________________________________
linuxtv-commits mailing list -- [email protected]
To unsubscribe send an email to [email protected]
