In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
media: msi2500: Return queued buffers on start_streaming() failure<\/p>\n
The vb2 framework hands buffers to the driver via buf_queue() before
\ncalling start_streaming(). If start_streaming() returns an error
\nwithout first returning those buffers via vb2_buffer_done(),
\nvb2_start_streaming() fires WARN_ON(owned_by_drv_count) and the queued
\nbuffers leak.<\/p>\n
msi2500_start_streaming() had five error paths that all hit this trap
\nand were further tangled by ret-overwriting between calls:<\/p>\n
– -ENODEV when the USB device was already disconnected
\n – -ERESTARTSYS when mutex_lock_interruptible() was interrupted
\n – msi2500_set_usb_adc() failure: ret was silently overwritten by
\n the next call (msi2500_isoc_init), so the error was lost entirely
\n – msi2500_isoc_init() failure: cleanup_queued_bufs was called, but
\n the function then fell through to msi2500_ctrl_msg() and again
\n masked the original error by overwriting ret
\n – msi2500_ctrl_msg(CMD_START_STREAMING) failure: no cleanup at all,
\n leaving isoc URBs submitted with no way for the driver to consume
\n them<\/p>\n
Consolidate the error paths into a small goto chain. Every failure
\nnow stops the function, drains the queued-buffer list, and returns
\nthe real error code. The ctrl_msg failure path also rolls back the
\npreceding msi2500_isoc_init() via msi2500_isoc_cleanup() before
\nunlocking and draining.<\/p>\n
The cleanup helper takes a vb2_buffer_state argument so that the
\nstart_streaming error paths can pass VB2_BUF_STATE_QUEUED (as
\nexpected by userspace on start_streaming failure) while stop_streaming
\nkeeps its existing VB2_BUF_STATE_ERROR semantics.<\/p>\n
This mirrors the uvcvideo fix in commit 4cf3b6fd54eb (“media: uvcvideo:
\nReturn queued buffers on start_streaming() failure”).<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
media: msi2500: Return queued buffers on start_streaming() failure<\/p>\n
The vb2 framework hands buffers to the driver via buf_queue() b<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-5389","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/5389","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=5389"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=5389"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=5389"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}