In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
media: rtl2832_sdr: release URBs and stream buffers on start_streaming() failure<\/p>\n
rtl2832_sdr_start_streaming() calls rtl2832_sdr_alloc_stream_bufs(),
\nrtl2832_sdr_alloc_urbs() and rtl2832_sdr_submit_urbs() in sequence and
\nshares a single err: label that only unlocks the mutex and returns.
\nWhen alloc_urbs() succeeds but submit_urbs() fails, or when alloc_urbs()
\nitself returns -ENOMEM after alloc_stream_bufs() has already succeeded,
\nthe URBs and\/or the coherent DMA stream buffers stay allocated while
\nstreaming reports failure to vb2. Two latent defects follow on the next
\nVIDIOC_STREAMON:<\/p>\n
1) rtl2832_sdr_alloc_stream_bufs() unconditionally resets dev->buf_num
\n to 0 and overwrites dev->buf_list[]\/dev->dma_addr[], permanently
\n leaking the coherent DMA memory allocated by the previous attempt.<\/p>\n
2) rtl2832_sdr_alloc_urbs() never resets dev->urbs_initialized and only
\n increments it. After a second successful pass urbs_initialized can
\n exceed MAX_BULK_BUFS, so the subsequent rtl2832_sdr_free_urbs() walks
\n from urbs_initialized – 1 down to 0 and reads past the end of
\n dev->urb_list[], passing garbage pointers to usb_free_urb().<\/p>\n
Mirror the teardown that stop_streaming() already performs: on the error
\npath call rtl2832_sdr_free_urbs() and rtl2832_sdr_free_stream_bufs()
\nbefore unlocking. Both helpers are idempotent (free_urbs kills and zeros
\nurbs_initialized; free_stream_bufs is gated on URB_BUF and clears the
\nbuf_num counter), so partial-failure paths and the no-allocation paths
\nremain safe.<\/p>\n
Issue identified by automated review of the INV-003 series at
\nhttps:\/\/sashiko.dev\/<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
media: rtl2832_sdr: release URBs and stream buffers on start_streaming() failure<\/p>\n
rtl2832_sdr_start_streaming() calls rtl2832_sdr_a<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-24567","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/24567","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=24567"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=24567"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=24567"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}