[media.git/next] media: rc: iguanair: handle timeouts

[media-ci]

On Tue Nov 26 14:17:22 2024 +0100, Oliver Neukum wrote:
> In case of a timeout the IO must be cancelled or
> the next IO using the URB will fail and/or overwrite
> an operational URB.
> 
> The automatic bisection fails because it arrives
> at a commit that correctly lets the test case run
> without an error.
> 
> Signed-off-by: Oliver Neukum <oneu...@suse.com>
> Fixes: e99a7cfe93fd ("[media] iguanair: reuse existing urb callback for 
> command responses")
> Reported-by: syzbot+ffba8e636870dac0e...@syzkaller.appspotmail.com
> Closes: 
> https://lore.kernel.org/all/66f5cc9a.050a0220.46d20.0004....@google.com/
> Tested-by: syzbot+ffba8e636870dac0e...@syzkaller.appspotmail.com
> Signed-off-by: Sean Young <s...@mess.org>
> Signed-off-by: Mauro Carvalho Chehab <mchehab+hua...@kernel.org>

Patch committed.

Thanks,
Mauro Carvalho Chehab

 drivers/media/rc/iguanair.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

---

diff --git a/drivers/media/rc/iguanair.c b/drivers/media/rc/iguanair.c
index 276bf3c8a8cb..8af94246e591 100644
--- a/drivers/media/rc/iguanair.c
+++ b/drivers/media/rc/iguanair.c
@@ -194,8 +194,10 @@ static int iguanair_send(struct iguanair *ir, unsigned 
size)
        if (rc)
                return rc;
 
-       if (wait_for_completion_timeout(&ir->completion, TIMEOUT) == 0)
+       if (wait_for_completion_timeout(&ir->completion, TIMEOUT) == 0) {
+               usb_kill_urb(ir->urb_out);
                return -ETIMEDOUT;
+       }
 
        return rc;
 }