linux-kernel - Re: [PATCH] media: usb: siano: do not free urb-specific transfer buffer

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <a503e593-ae2f-44f4-b545-b64201bd21f1@fintech.ru>
Date: Mon, 9 Jun 2025 13:37:39 +0300
From: Nikita Zhandarovich <n.zhandarovich@...tech.ru>
To: Mauro Carvalho Chehab <mchehab@...nel.org>
CC: Hans Verkuil <hverkuil-cisco@...all.nl>, <linux-media@...r.kernel.org>,
	<linux-kernel@...r.kernel.org>, <lvc-project@...uxtesting.org>, Hillf Danton
	<hdanton@...a.com>, <syzbot+b466336413a1fba398a5@...kaller.appspotmail.com>
Subject: Re: [PATCH] media: usb: siano: do not free urb-specific transfer
 buffer

Gentle ping...

On 5/22/25 17:00, Nikita Zhandarovich wrote:
> Since siano driver uses separately allocated buffers for urb tranfers,
> such as smscore_buffer_t *cb, and deals with them accordingly
> via calls to smscore_putbuffer() in smsusb_stop_streaming(), there is
> no need to attempt to free urb->transfer_buffer by adding a
> URB_FREE_BUFFER to urb transfer flags. As syzkaller shows, it triggers
> a warning which will bring about proper crash on systems with
> 'panic_on_warn' set.
> 
> Therefore, skip the flag setting step to fix the issue. This change
> was tested exclusively with syz-repros and KMEMLEAK sanitizer.
> 
> The idea for this patch was originally devised by Hillf Danton.
> 
> Suggested-by: Hillf Danton <hdanton@...a.com>
> Reported-by: syzbot+b466336413a1fba398a5@...kaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=b466336413a1fba398a5
> Fixes: 564246fd3ff4 ("media: siano: Fix coherent memory allocation failure on arm64")
> Signed-off-by: Nikita Zhandarovich <n.zhandarovich@...tech.ru>
> ---
>  drivers/media/usb/siano/smsusb.c | 1 -
>  1 file changed, 1 deletion(-)
> 
> diff --git a/drivers/media/usb/siano/smsusb.c b/drivers/media/usb/siano/smsusb.c
> index 2c8179a84991..a78b1c233aad 100644
> --- a/drivers/media/usb/siano/smsusb.c
> +++ b/drivers/media/usb/siano/smsusb.c
> @@ -168,7 +168,6 @@ static int smsusb_submit_urb(struct smsusb_device_t *dev,
>  		smsusb_onresponse,
>  		surb
>  	);
> -	surb->urb->transfer_flags |= URB_FREE_BUFFER;
>  
>  	return usb_submit_urb(surb->urb, GFP_ATOMIC);
>  }