In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
media: rtl2832_sdr: Return queued buffers on start_streaming() failure<\/p>\n
The vb2 framework hands buffers to the driver via buf_queue() before
\ncalling start_streaming(). If start_streaming() returns an error
\nwithout first returning those buffers via vb2_buffer_done(),
\nvb2_start_streaming() fires WARN_ON(owned_by_drv_count) and the queued
\nbuffers leak.<\/p>\n
rtl2832_sdr_start_streaming() had multiple error paths that hit this
\ntrap: two direct early returns (-ENODEV, -ERESTARTSYS), plus six
\n`goto err` paths covering subdev s_power, tuner setup, ADC setup,
\nstream-buffer allocation, urb allocation, and urb submission failures.
\nNone of them returned the queued buffers.<\/p>\n
The original function had no distinct success exit and fell straight
\nthrough into the err label, which previously only did mutex_unlock and
\n“return ret”. Adding queued-buffer cleanup at err must therefore be
\npaired with an explicit success return; otherwise every successful
\nstart would also drain the buffer queue and kill streaming. Add that
\nsuccess return, then add rtl2832_sdr_cleanup_queued_bufs() at the err
\nlabel and before each early return.<\/p>\n
The cleanup helper takes a vb2_buffer_state argument so that the
\nstart_streaming error paths can pass VB2_BUF_STATE_QUEUED (as
\nexpected by userspace on start_streaming failure) while stop_streaming
\nkeeps its existing VB2_BUF_STATE_ERROR semantics.<\/p>\n
This mirrors the uvcvideo fix in commit 4cf3b6fd54eb (“media: uvcvideo:
\nReturn queued buffers on start_streaming() failure”).<\/p>\n
The err label still does not roll back power_ctrl(), frontend_ctrl(),
\nthe POWER_ON flag, or stream\/URB allocations that may have happened
\nbefore the failing step. Those are pre-existing leaks of a different
\nclass and are not addressed here.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
media: rtl2832_sdr: Return queued buffers on start_streaming() failure<\/p>\n
The vb2 framework hands buffers to the driver via buf_queue<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-5386","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/5386","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=5386"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=5386"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=5386"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}