Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

media: rc: iguanair: handle timeouts

In case of a timeout the IO must be cancelled or
the next IO using the URB will fail and/or overwrite
an operational URB.

The automatic bisection fails because it arrives
at a commit that correctly lets the test case run
without an error.

Signed-off-by: Oliver Neukum <oneukum@suse.com>
Fixes: e99a7cfe93fd ("[media] iguanair: reuse existing urb callback for command responses")
Reported-by: syzbot+ffba8e636870dac0e0c0@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/all/66f5cc9a.050a0220.46d20.0004.GAE@google.com/
Tested-by: syzbot+ffba8e636870dac0e0c0@syzkaller.appspotmail.com
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>

authored by

Oliver Neukum and committed by
Mauro Carvalho Chehab
b98d5000 ff8f969d

+3 -1
+3 -1
drivers/media/rc/iguanair.c
··· 194 194 if (rc) 195 195 return rc; 196 196 197 - if (wait_for_completion_timeout(&ir->completion, TIMEOUT) == 0) 197 + if (wait_for_completion_timeout(&ir->completion, TIMEOUT) == 0) { 198 + usb_kill_urb(ir->urb_out); 198 199 return -ETIMEDOUT; 200 + } 199 201 200 202 return rc; 201 203 }