media: em28xx: add missing em28xx_close_extension
authorPavel Skripkin <paskripkin@gmail.com>
Thu, 29 Jul 2021 20:23:33 +0000 (22:23 +0200)
committerMauro Carvalho Chehab <mchehab+huawei@kernel.org>
Thu, 30 Sep 2021 08:07:38 +0000 (10:07 +0200)
commit2c98b8a3458df03abdc6945bbef67ef91d181938
tree566d6ac69fe8fbed47fc78587ae564240605ee54
parent9015fcc256d3a74d4fdc3d87877e270968550444
media: em28xx: add missing em28xx_close_extension

If em28xx dev has ->dev_next pointer, we need to delete ->dev_next list
node from em28xx_extension_devlist on disconnect to avoid UAF bugs and
corrupted list bugs, since driver frees this pointer on disconnect.

Reported-and-tested-by: syzbot+a6969ef522a36d3344c9@syzkaller.appspotmail.com
Fixes: 1a23f81b7dc3 ("V4L/DVB (9979): em28xx: move usb probe code to a proper place")
Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
drivers/media/usb/em28xx/em28xx-cards.c