In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
media: sun4i-csi: Return queued buffers on start_streaming() failure<\/p>\n
The vb2 framework hands buffers to the driver via buf_queue() before
\ncalling start_streaming(). If start_streaming() returns an error
\nwithout first returning those buffers via vb2_buffer_done(),
\nvb2_start_streaming() fires WARN_ON(owned_by_drv_count) and the queued
\nbuffers leak.<\/p>\n
sun4i_csi_start_streaming() returned -EINVAL when no matching CSI
\nformat could be found, before any setup (scratch buffer allocation,
\npipeline start) had been performed. The remaining error paths already
\nconverge on the err_clear_dma_queue label, which calls
\nreturn_all_buffers(…, VB2_BUF_STATE_QUEUED) under csi->qlock. Jump
\nto that label directly: the intermediate err_disable_device \/
\nerr_disable_pipeline \/ err_free_scratch_buffer labels are skipped,
\nwhich is correct because nothing they would undo has happened yet.<\/p>\n
This mirrors the uvcvideo fix in commit 4cf3b6fd54eb (“media: uvcvideo:
\nReturn queued buffers on start_streaming() failure”).<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
media: sun4i-csi: Return queued buffers on start_streaming() failure<\/p>\n
The vb2 framework hands buffers to the driver via buf_queue()<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-5384","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/5384","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=5384"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=5384"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=5384"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}