linux-kernel - Re: [PATCH] media: pvrusb2: fix URB leak in pvr2_send_request

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <c3ced43d-ca75-b4eb-96d2-9629f6e1f112@isely.net>
Date: Sat, 20 Dec 2025 14:03:56 -0600 (CST)
From: Mike Isely <isely@...ly.net>
To: Szymon Wilczek <szymonwilczek@....com>
cc: mchehab@...nel.org, linux-media@...r.kernel.org,
  Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
  syzkaller-bugs@...glegroups.com,
  syzbot+405dcd13121ff75a9e16@...kaller.appspotmail.com,
  Mike Isely at pobox <isely@...ox.com>
Subject: Re: [PATCH] media: pvrusb2: fix URB leak in pvr2_send_request_ex


Acked-By: Mike Isely <isely@...ox.com>

On Sat, 20 Dec 2025, Szymon Wilczek wrote:

> When pvr2_send_request_ex() submits a write URB successfully but fails to submit the read URB (e.g. returns -ENOMEM), it returns immediately without waiting for the write URB to complete. Since the driver reuses the same URB structure, a subsequent call to pvr2_send_request_ex() attempts to submit the still-active write URB, triggering a 'URB submitted while active' warning in usb_submit_urb().
> 
> Fix this by ensuring the write URB is unlinked and waited upon if the read URB submission fails.
> 
> Reported-by: syzbot+405dcd13121ff75a9e16@...kaller.appspotmail.com
> 
> Closes: https://syzkaller.appspot.com/bug?extid=405dcd13121ff75a9e16
> Signed-off-by: Szymon Wilczek <szymonwilczek@....com>
> ---
>  drivers/media/usb/pvrusb2/pvrusb2-hdw.c | 5 +++++
>  1 file changed, 5 insertions(+)
> 
> diff --git a/drivers/media/usb/pvrusb2/pvrusb2-hdw.c b/drivers/media/usb/pvrusb2/pvrusb2-hdw.c
> index b32bb906a9de..5807734ae26c 100644
> --- a/drivers/media/usb/pvrusb2/pvrusb2-hdw.c
> +++ b/drivers/media/usb/pvrusb2/pvrusb2-hdw.c
> @@ -3709,6 +3709,11 @@ status);
>  				   "Failed to submit read-control URB status=%d",
>  status);
>  			hdw->ctl_read_pend_flag = 0;
> +			if (hdw->ctl_write_pend_flag) {
> +				usb_unlink_urb(hdw->ctl_write_urb);
> +				while (hdw->ctl_write_pend_flag)
> +					wait_for_completion(&hdw->ctl_done);
> +			}
>  			goto done;
>  		}
>  	}
>