On Wed Aug 12 23:12:35 2026 -0400, Shuangpeng Bai wrote:
> gspca uses vb2_fop_release(), but gspca_disconnect() only unregisters
> the video device. If the queue owner closes the device after USB
> disconnect, vb2_fop_release() releases the queue and invokes
> gspca_stop_streaming() at that point.
>
> gspca_stream_off() calls subdriver stop callbacks and
> usb_set_interface() through gspca_dev->dev. By the time the late close
> runs, the USB core can have freed the usb_device, resulting in a
> use-after-free. This was observed as a KASAN use-after-free in sd_stopN().
>
> Use vb2_video_unregister_device() so the queue is released and streaming
> is stopped synchronously during disconnect, while the usb_device is still
> valid. Since the helper takes the queue lock, which is usb_lock, call it
> after dropping that lock.
>
> Fixes: f729ef5796d8 ("media: videobuf2-v4l2.c: add
> vb2_video_unregister_device helper function")
> Cc: [email protected] # 5.10.x
> Suggested-by: Hans Verkuil <[email protected]>
> Signed-off-by: Shuangpeng Bai <[email protected]>
> Signed-off-by: Hans Verkuil <[email protected]>
Patch committed.
Thanks,
Hans Verkuil
drivers/media/usb/gspca/gspca.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
---
diff --git a/drivers/media/usb/gspca/gspca.c b/drivers/media/usb/gspca/gspca.c
index 594d73e50b9f..4185c9047241 100644
--- a/drivers/media/usb/gspca/gspca.c
+++ b/drivers/media/usb/gspca/gspca.c
@@ -1636,9 +1636,8 @@ void gspca_disconnect(struct usb_interface *intf)
#endif
v4l2_device_disconnect(&gspca_dev->v4l2_dev);
- video_unregister_device(&gspca_dev->vdev);
-
mutex_unlock(&gspca_dev->usb_lock);
+ vb2_video_unregister_device(&gspca_dev->vdev);
/* (this will call gspca_release() immediately or on last close) */
v4l2_device_put(&gspca_dev->v4l2_dev);
_______________________________________________
linuxtv-commits mailing list -- [email protected]
To unsubscribe send an email to [email protected]
