On Sat Dec 20 19:24:19 2025 +0100, Szymon Wilczek wrote:
> When pvr2_send_request_ex() submits a write URB successfully but fails to
> submit the read URB (e.g. returns -ENOMEM), it returns immediately without
> waiting for the write URB to complete. Since the driver reuses the same
> URB structure, a subsequent call to pvr2_send_request_ex() attempts to
> submit the still-active write URB, triggering a 'URB submitted while
> active' warning in usb_submit_urb().
>
> Fix this by ensuring the write URB is unlinked and waited upon if the read
> URB submission fails.
>
> Reported-by: [email protected]
> Closes: https://syzkaller.appspot.com/bug?extid=405dcd13121ff75a9e16
> Signed-off-by: Szymon Wilczek <[email protected]>
> Acked-by: Mike Isely <[email protected]>
> Signed-off-by: Hans Verkuil <[email protected]>
Patch committed.
Thanks,
Hans Verkuil
drivers/media/usb/pvrusb2/pvrusb2-hdw.c | 5 +++++
1 file changed, 5 insertions(+)
---
diff --git a/drivers/media/usb/pvrusb2/pvrusb2-hdw.c
b/drivers/media/usb/pvrusb2/pvrusb2-hdw.c
index b32bb906a9de..5807734ae26c 100644
--- a/drivers/media/usb/pvrusb2/pvrusb2-hdw.c
+++ b/drivers/media/usb/pvrusb2/pvrusb2-hdw.c
@@ -3709,6 +3709,11 @@ status);
"Failed to submit read-control URB
status=%d",
status);
hdw->ctl_read_pend_flag = 0;
+ if (hdw->ctl_write_pend_flag) {
+ usb_unlink_urb(hdw->ctl_write_urb);
+ while (hdw->ctl_write_pend_flag)
+ wait_for_completion(&hdw->ctl_done);
+ }
goto done;
}
}
_______________________________________________
linuxtv-commits mailing list -- [email protected]
To unsubscribe send an email to [email protected]
