diff options
| author | Diego Fernando Mancera Gomez <diegomancera.dev@gmail.com> | 2026-07-23 12:22:42 -0600 |
|---|---|---|
| committer | Hans Verkuil <hverkuil+cisco@kernel.org> | 2026-07-28 16:48:20 +0200 |
| commit | 95f76f51937fdfb0fc1e14cae606b1ef574a56f3 (patch) | |
| tree | 343e5202b45909a2b2816fba28dfac66c324f5a7 /drivers/media/usb | |
| parent | 81f0403d4eda80ad304758da16174044d7f8055b (diff) | |
| download | linux-next-95f76f51937fdfb0fc1e14cae606b1ef574a56f3.tar.gz linux-next-95f76f51937fdfb0fc1e14cae606b1ef574a56f3.zip | |
media: em28xx: defer audio-only extension registration
The audio-only path registers extensions while probing the primary device.
For a dual-TS board, this happens before dev_next is created. The duplicate
device inherits is_audio_only and is then independently inserted into
em28xx_devlist.
The list is intended to contain only primary devices: extension operations
reach the secondary device through dev_next. The independently linked
secondary can be freed during disconnect while its list node remains
reachable, resulting in a use-after-free.
Defer audio-only extension registration to the module-request work item. It
runs only after probing has completed construction of the optional
secondary device, so only the primary is registered and extension callbacks
reach the secondary through dev_next.
Fixes: 4a089668ef22 ("media: em28xx-cards: rework the em28xx probing code")
Cc: stable@vger.kernel.org
Reported-by: syzbot+a11c46f37ee083a73deb@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/all/66ec3c83.050a0220.29194.002f.GAE@google.com/T/
Suggested-by: Fedor Pchelkin <pchelkin@ispras.ru>
Signed-off-by: Diego Fernando Mancera Gomez <diegomancera.dev@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Diffstat (limited to 'drivers/media/usb')
| -rw-r--r-- | drivers/media/usb/em28xx/em28xx-cards.c | 3 |
1 files changed, 1 insertions, 2 deletions
diff --git a/drivers/media/usb/em28xx/em28xx-cards.c b/drivers/media/usb/em28xx/em28xx-cards.c index b94b00456bcd..b7c534fc8a21 100644 --- a/drivers/media/usb/em28xx/em28xx-cards.c +++ b/drivers/media/usb/em28xx/em28xx-cards.c @@ -3675,6 +3675,7 @@ static void request_module_async(struct work_struct *work) * intf. Don't register extensions twice on those devices. */ if (dev->is_audio_only) { + em28xx_init_extension(dev); #if defined(CONFIG_MODULES) && defined(MODULE) request_module("em28xx-alsa"); #endif @@ -3913,8 +3914,6 @@ static int em28xx_init_dev(struct em28xx *dev, struct usb_device *udev, retval = -ENODEV; goto err_deinit_media; } - em28xx_init_extension(dev); - return 0; } |