Commit 6cf97230 authored by Oliver Neukum's avatar Oliver Neukum Committed by Mauro Carvalho Chehab

media: dvb: usb: fix use after free in dvb_usb_device_exit

dvb_usb_device_exit() frees and uses the device name in that order.
Fix by storing the name in a buffer before freeing it.
Signed-off-by: default avatarOliver Neukum <oneukum@suse.com>
Reported-by: syzbot+26ec41e9f788b3eba396@syzkaller.appspotmail.com
Signed-off-by: default avatarSean Young <sean@mess.org>
Signed-off-by: default avatarMauro Carvalho Chehab <mchehab+samsung@kernel.org>
parent 24e4cf77
...@@ -287,12 +287,15 @@ EXPORT_SYMBOL(dvb_usb_device_init); ...@@ -287,12 +287,15 @@ EXPORT_SYMBOL(dvb_usb_device_init);
void dvb_usb_device_exit(struct usb_interface *intf) void dvb_usb_device_exit(struct usb_interface *intf)
{ {
struct dvb_usb_device *d = usb_get_intfdata(intf); struct dvb_usb_device *d = usb_get_intfdata(intf);
const char *name = "generic DVB-USB module"; const char *default_name = "generic DVB-USB module";
char name[40];
usb_set_intfdata(intf, NULL); usb_set_intfdata(intf, NULL);
if (d != NULL && d->desc != NULL) { if (d != NULL && d->desc != NULL) {
name = d->desc->name; strscpy(name, d->desc->name, sizeof(name));
dvb_usb_exit(d); dvb_usb_exit(d);
} else {
strscpy(name, default_name, sizeof(name));
} }
info("%s successfully deinitialized and disconnected.", name); info("%s successfully deinitialized and disconnected.", name);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment