In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
media: pwc: Return queued buffers on start_streaming() failure<\/p>\n
The vb2 framework hands buffers to the driver via buf_queue() before
\ncalling start_streaming(). If start_streaming() returns an error
\nwithout first returning those buffers via vb2_buffer_done(),
\nvb2_start_streaming() fires WARN_ON(owned_by_drv_count) and the queued
\nbuffers leak.<\/p>\n
pwc’s start_streaming() had two early returns that hit this trap:
\n-ENODEV when the USB device was already disconnected, and -ERESTARTSYS
\nwhen mutex_lock_interruptible() was interrupted by a signal. Call the
\nexisting pwc_cleanup_queued_bufs() helper with VB2_BUF_STATE_QUEUED
\nbefore returning (matching the state already used by the
\npwc_isoc_init() error path in the same function).<\/p>\n
This mirrors the uvcvideo fix in commit 4cf3b6fd54eb (“media: uvcvideo:
\nReturn queued buffers on start_streaming() failure”).<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
media: pwc: Return queued buffers on start_streaming() failure<\/p>\n
The vb2 framework hands buffers to the driver via buf_queue() befor<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-5387","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/5387","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=5387"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=5387"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=5387"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}