@@ -276,10 +276,9 @@ static int uvcg_video_usb_req_queue(struct uvc_video *video,
bool is_bulk = video->max_payload_size;
struct list_head *list = NULL;
- if (!video->is_enabled) {
- uvc_video_free_request(req->context, video->ep);
+ if (!video->is_enabled)
return -ENODEV;
- }
+
if (queue_to_ep) {
struct uvc_request *ureq = req->context;
/*
@@ -464,8 +463,15 @@ uvc_video_complete(struct usb_ep *ep, struct usb_request *req)
* and this thread for isoc endpoints.
*/
ret = uvcg_video_usb_req_queue(video, to_queue, !is_bulk);
- if (ret < 0)
+ if (ret < 0) {
+ /*
+ * Endpoint error, but the stream is still enabled.
+ * Put request back in req_free for it to be cleaned
+ * up later.
+ */
uvcg_queue_cancel(queue, 0);
+ list_add_tail(&to_queue->list, &video->req_free);
+ }
} else {
uvc_video_free_request(ureq, ep);
}
There is a path that may lead to freed memory being referenced, causing kernel panics. The kernel panic has the following stack trace: Workqueue: uvcgadget uvcg_video_pump.c51fb85fece46625450f86adbf92c56c.cfi_jt pstate: 60c00085 (nZCv daIf +PAN +UAO -TCO BTYPE=--) pc : __list_del_entry_valid+0xc0/0xd4 lr : __list_del_entry_valid+0xc0/0xd4 Call trace: __list_del_entry_valid+0xc0/0xd4 uvc_video_free_request+0x60/0x98 uvcg_video_pump+0x1cc/0x204 process_one_work+0x21c/0x4b8 worker_thread+0x29c/0x574 kthread+0x158/0x1b0 ret_from_fork+0x10/0x30 The root cause is that uvcg_video_usb_req_queue frees the uvc_request if is_enabled is false and returns an error status. video_pump also frees the associated request if uvcg_video_usb_req_queue returns an error status, leading to double free and accessing garbage memory. To fix the issue, this patch removes freeing logic from uvcg_video_usb_req_queue, and lets the callers to the function handle queueing errors as they see fit. Fixes: 6acba0345b68 ("usb:gadget:uvc Do not use worker thread to pump isoc usb requests") Tested-by: Avichal Rakesh <arakesh@google.com> Signed-off-by: Avichal Rakesh <arakesh@google.com> --- v1 -> v2: Address review comment; add "Fixes" tag; fix goofy line wrap drivers/usb/gadget/function/uvc_video.c | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) -- 2.43.0.472.g3155946c3a-goog