mirrors/linux
2
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-08-31 02:21:39 -04:00
Code Issues Packages Projects Releases Wiki Activity

media: cx231xx: fix null pointer deref in snd_cx231xx_pcm_close

Browse Source 
Add a null check for the dev pointer after retrieving it from
the substream. Without this, a use-after-free or null pointer
dereference can occur when closing the audio device, causing
a kernel page fault.

Link: https://bugzilla.redhat.com/show_bug.cgi?id=2365068
Signed-off-by: Ashwin Gundarapu <linuxuser509@zohomail.in>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
This commit is contained in:
Ashwin Gundarapu
2026-05-22 21:16:52 +05:30
committed by Hans Verkuil
parent bedd5ea6b7
commit ab8c3ed895
1 changed files with 5 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
drivers/media/usb/cx231xx/cx231xx-audio.c
View File

@@ -443,6 +443,11 @@ static int snd_cx231xx_pcm_close(struct snd_pcm_substream *substream)
int ret;
struct cx231xx *dev = snd_pcm_substream_chip(substream);
if (!dev) {
pr_err("cx231xx: called with null device\n");
return -ENODEV;
}
dev_dbg(dev->dev, "closing device\n");
/* inform hardware to stop streaming */