diff --git a/patches.suse/media-dvbdev-fix-error-logic-at-dvb_register_device.patch b/patches.suse/media-dvbdev-fix-error-logic-at-dvb_register_device.patch new file mode 100644 index 0000000..ee4a8fb --- /dev/null +++ b/patches.suse/media-dvbdev-fix-error-logic-at-dvb_register_device.patch @@ -0,0 +1,55 @@ +From 1fec2ecc252301110e4149e6183fa70460d29674 Mon Sep 17 00:00:00 2001 +From: Mauro Carvalho Chehab +Date: Wed, 9 Jun 2021 14:32:29 +0200 +Subject: [PATCH] media: dvbdev: fix error logic at dvb_register_device() +Git-commit: 1fec2ecc252301110e4149e6183fa70460d29674 +Patch-mainline: v5.14-rc1 +References: CVE-2022-45884 bsc#1205756 + +As reported by smatch: + + drivers/media/dvb-core/dvbdev.c: drivers/media/dvb-core/dvbdev.c:510 dvb_register_device() warn: '&dvbdev->list_head' not removed from list + drivers/media/dvb-core/dvbdev.c: drivers/media/dvb-core/dvbdev.c:530 dvb_register_device() warn: '&dvbdev->list_head' not removed from list + drivers/media/dvb-core/dvbdev.c: drivers/media/dvb-core/dvbdev.c:545 dvb_register_device() warn: '&dvbdev->list_head' not removed from list + +The error logic inside dvb_register_device() doesn't remove +devices from the dvb_adapter_list in case of errors. + +Signed-off-by: Mauro Carvalho Chehab +Acked-by: Takashi Iwai + +--- + drivers/media/dvb-core/dvbdev.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/media/dvb-core/dvbdev.c b/drivers/media/dvb-core/dvbdev.c +index 3862ddc86ec4..795d9bfaba5c 100644 +--- a/drivers/media/dvb-core/dvbdev.c ++++ b/drivers/media/dvb-core/dvbdev.c +@@ -506,6 +506,7 @@ int dvb_register_device(struct dvb_adapter *adap, struct dvb_device **pdvbdev, + break; + + if (minor == MAX_DVB_MINORS) { ++ list_del (&dvbdev->list_head); + kfree(dvbdevfops); + kfree(dvbdev); + up_write(&minor_rwsem); +@@ -526,6 +527,7 @@ int dvb_register_device(struct dvb_adapter *adap, struct dvb_device **pdvbdev, + __func__); + + dvb_media_device_free(dvbdev); ++ list_del (&dvbdev->list_head); + kfree(dvbdevfops); + kfree(dvbdev); + mutex_unlock(&dvbdev_register_lock); +@@ -541,6 +543,7 @@ int dvb_register_device(struct dvb_adapter *adap, struct dvb_device **pdvbdev, + pr_err("%s: failed to create device dvb%d.%s%d (%ld)\n", + __func__, adap->num, dnames[type], id, PTR_ERR(clsdev)); + dvb_media_device_free(dvbdev); ++ list_del (&dvbdev->list_head); + kfree(dvbdevfops); + kfree(dvbdev); + return PTR_ERR(clsdev); +-- +2.35.3 + diff --git a/series.conf b/series.conf index c446d29..2ee8c40 100644 --- a/series.conf +++ b/series.conf @@ -20999,6 +20999,7 @@ patches.suse/media-dvd_usb-memory-leak-in-cinergyt2_fe_attach.patch patches.suse/media-uvcvideo-Fix-pixel-format-change-for-Elgato-Ca.patch patches.suse/media-dvb_net-avoid-speculation-from-net-slot.patch + patches.suse/media-dvbdev-fix-error-logic-at-dvb_register_device.patch patches.suse/media-siano-fix-device-register-error-path.patch patches.suse/media-imx-csi-Skip-first-few-frames-from-a-BT.656-so.patch patches.suse/media-s5p-g2d-Fix-a-memory-leak-on-ctx-fh.m2m_ctx.patch