[PATCH 5.10 166/663] media: em28xx: Fix use-after-free in em28xx_alloc_urbs

[Greg Kroah-Hartman]

From: Dinghao Liu <dinghao....@zju.edu.cn>

[ Upstream commit a26efd1961a18b91ae4cd2e433adbcf865b40fa3 ]

When kzalloc() fails, em28xx_uninit_usb_xfer() will free
usb_bufs->buf and set it to NULL. Thus the later access
to usb_bufs->buf[i] will lead to null pointer dereference.
Also the kfree(usb_bufs->buf) after that is redundant.

Fixes: d571b592c6206 ("media: em28xx: don't use coherent buffer for DMA 
transfers")
Signed-off-by: Dinghao Liu <dinghao....@zju.edu.cn>
Signed-off-by: Hans Verkuil <hverkuil-ci...@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+hua...@kernel.org>
Signed-off-by: Sasha Levin <sas...@kernel.org>
---
 drivers/media/usb/em28xx/em28xx-core.c | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/drivers/media/usb/em28xx/em28xx-core.c 
b/drivers/media/usb/em28xx/em28xx-core.c
index e6088b5d1b805..3daa64bb1e1d9 100644
--- a/drivers/media/usb/em28xx/em28xx-core.c
+++ b/drivers/media/usb/em28xx/em28xx-core.c
@@ -956,14 +956,10 @@ int em28xx_alloc_urbs(struct em28xx *dev, enum 
em28xx_mode mode, int xfer_bulk,
 
                usb_bufs->buf[i] = kzalloc(sb_size, GFP_KERNEL);
                if (!usb_bufs->buf[i]) {
-                       em28xx_uninit_usb_xfer(dev, mode);
-
                        for (i--; i >= 0; i--)
                                kfree(usb_bufs->buf[i]);
 
-                       kfree(usb_bufs->buf);
-                       usb_bufs->buf = NULL;
-
+                       em28xx_uninit_usb_xfer(dev, mode);
                        return -ENOMEM;
                }
 
-- 
2.27.0