CVE-2025-22027
media: streamzap: fix race between device disconnection and urb callback
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
media: streamzap: fix race between device disconnection and urb callback
In the Linux kernel, the following vulnerability has been resolved: media: streamzap: fix race between device disconnection and urb callback Syzkaller has reported a general protection fault at function ir_raw_event_store_with_filter(). This crash is caused by a NULL pointer dereference of dev->raw pointer, even though it is checked for NULL in the same function, which means there is a race condition. It occurs due to the incorrect order of actions in the streamzap_disconnect() function: rc_unregister_device() is called before usb_kill_urb(). The dev->raw pointer is freed and set to NULL in rc_unregister_device(), and only after that usb_kill_urb() waits for in-progress requests to finish. If rc_unregister_device() is called while streamzap_callback() handler is not finished, this can lead to accessing freed resources. Thus rc_unregister_device() should be called after usb_kill_urb(). Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
Reserved 2024-12-29 | Published 2025-04-16 | Updated 2025-05-26 | Assigner Linuxgit.kernel.org/...c/e11652a6514ec805440c1bb3739e6c6236fffcc7
git.kernel.org/...c/f1d518c0bad01abe83c2df880274cb6a39f4a457
git.kernel.org/...c/30ef7cfee752ca318d5902cb67b60d9797ccd378
git.kernel.org/...c/15483afb930fc2f883702dc96f80efbe4055235e
git.kernel.org/...c/adf0ddb914c9e5b3e50da4c97959e82de2df75c3
git.kernel.org/...c/4db62b60af2ccdea6ac5452fd20e29587ed85f57
git.kernel.org/...c/8760da4b9d44c36b93b6e4cf401ec7fe520015bd
git.kernel.org/...c/f656cfbc7a293a039d6a0c7100e1c846845148c1
Support options
