From nobody Fri Oct 2 09:22:05 2026 Received: from mail-pj1-f43.google.com (mail-pj1-f43.google.com [209.85.216.43]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 4F20924DCF6 for ; Mon, 3 Aug 2026 10:40:14 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.43 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785753615; cv=none; b=Lnq6aodcPX48sDpDnrcAXP6FRNG67kdzSsUv4EoKQx0zt3xdqJvJxAxgcYSRDDXyuSUC0UuQdcVDjcQtmSCCqnkvA2a81XwItlQFLkyL4WMKnejpOnr22mrLAkQ+TLGA5fZb3hPcEgv+prMh4e2MP9vS8xFsS3rsVNJe/4atkcU= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785753615; c=relaxed/simple; bh=wd36Mr3YTeEOobPW20YCTlYcPkBxI7qt5NNnKBJ1b2Q=; h=From:To:Cc:Subject:Date:Message-Id:MIME-Version; b=Q4PRVj4fvyfWSXo1OrD4kxsTSQmYLyGUCK3icWgntwxzW1UNK/tnfd1o1FhZH2QiomvNowhp2L0RAZJVyjJHztqgZOrrB2TLCRX2Sqc9lGP6GmoDMvWk53iWRVjGvwTsq2J3EFVX2s7v7+9rw4rZQadYjTbrTEj+5Uk1ybKzL2E= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=abUfNNwo; arc=none smtp.client-ip=209.85.216.43 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="abUfNNwo" Received: by mail-pj1-f43.google.com with SMTP id 98e67ed59e1d1-38101f85591so3063332a91.1 for ; Mon, 03 Aug 2026 03:40:14 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1785753613; x=1786358413; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=STul+ZYNBULZFVtjqLupAxbSwpG28GFI6NairUsKHOc=; b=abUfNNwoC8XBR7iGBXZYDB2duZPJk0EEfTAr5XAchvAaoZLLptP9JR/9SUMGPLNqSw OGFb88zWSRdkhpc6p7R8L5yh4gyHFtQ7bBZQBL1KI2Rj4BUn1p9LGaRpaC9A1O5Oa0aa +4qeN3W4ThXyG3y1+AXW4+TOdZZi/MZVMBr7417H1MieCJbDrPkwEX9uTLgpSKjGXDcW L9RFiPUHqjVxWX+gIB5bVcQt3ZrIhWAg7qIMlc73KeMHGSBTNrRkp+BVoclIDEFTppGM 3pm7g7UJg1Oz1jIyYAu74hF77hJ887zUsl/0z64ZzjOooRKgYK9PYgsbJYwjXcMPZEGs 9MPg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1785753613; x=1786358413; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=STul+ZYNBULZFVtjqLupAxbSwpG28GFI6NairUsKHOc=; b=FP8coySo24yS6qEEwg+rVD2cd3PVps5n/aM0vVC3zIss7SjSEygYfbGM+Lkb+lYiua nhGN5hns8kw4FRnYOtaiFLbbkH9hVmlk26s28H5vxSQ6vITy5QlgVyVxITrOHuPyAZx9 8OBlJWrdCJRhrh6+6y6zATCT4pGgBPqL8OmWV8oaV2KjZeA2+minnzDbsqefnHyUdYTE EEHu55MI6iVsXwdRV/YDbL3tl0Ntq89G0RN4RSBdoo33RHXAerFgZ62vjOtxCpmbWHsX ek+zmuwGeD2AY35/X5JC5ikZ7Nd4NSdqIq5W+5JbRU1d534Bp+5ESW3sSEErs2EmNc8U PnuQ== X-Forwarded-Encrypted: i=1; AHgh+Rp7gMJ6jr0EP31qsIve08uCUO+sqV3+vmxj3sVLYlm3ssecDUcQmVeiN3g32fnl7grUTPjChXQpaWav4ls=@vger.kernel.org X-Gm-Message-State: AOJu0Yx8tcxOhb0+kRwr5hame/A6emlGMj8WjDpZFXgSJuQW92Kggo/f M7ttSVn29ZOkCs/y87Q4YxWtZ5KUyS7pERab7NN2+54Urp6Kw6rpcErl X-Gm-Gg: AR+sD13iJrCd7e0OTuAQMPX+5A1goq/b91oQrPlCG0pHJFOLhe430zH0pirOgURjsIT kzBfy7LMR09An++QC9sx5oZ1xvh8YvLWA0Rd9VOQ+A0fcFuGuSp3mVUiAh7ahNtQYiiaP0mV5eO 9JRfGXsufgpq8UHyZpsshTjtg/JLOtPrqsTVS7ESYfVzbxlqg83VkKXVNFRqTxXZGp1FIvS0DBf 6NUwaz77k+fYIlklz8jCqUAECNLY8W+gRGVb90UU0mchDTtoQ4Wa0Mel1LcMliPt845dBHvxnnq nMmSZ0I+ByDpBhlysysZnQIw8eoHzyNZtPCXMv6JdfZGhWUE+ugn6Ro0K/4S10C+9LpTlJdVYpw kf6KhtV9dvPYmVdU4JDlc3JvJ01fs6ddp9BkVFmMHgumrqYh4AtuPmrabzUb9KWXDk5T95TXu/U neauhv4HC19xPnM0Dojemu20/bMiSA7SQChRwHXlUwoOr1avp0vGXVIJ2AvPSrJ/jAJ0h3lOMjc CNilbS+pG9vfW/PhvKk/jsna8pisbolnen8 X-Received: by 2002:a17:90b:17c5:b0:387:d5bd:622f with SMTP id 98e67ed59e1d1-38fbcae2162mr7349457a91.18.1785753613490; Mon, 03 Aug 2026 03:40:13 -0700 (PDT) Received: from ML-GYSUBT565.ECARX.COM.CN ([101.47.164.95]) by smtp.gmail.com with ESMTPSA id a92af1059eb24-13fab1334cfsm33263736c88.1.2026.08.03.03.40.11 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 03 Aug 2026 03:40:13 -0700 (PDT) From: Nguyen Quang Le Kien To: isely@pobox.com Cc: mchehab@kernel.org, linux-media@vger.kernel.org, linux-kernel@vger.kernel.org, syzbot+20fef510634faf733060@syzkaller.appspotmail.com, Nguyen Quang Le Kien Subject: [PATCH] media: pvrusb2: fix URB pending flag leak on invalid endpoint Date: Mon, 3 Aug 2026 18:40:08 +0800 Message-Id: <20260803104008.2605452-1-khiemtranzo532001@gmail.com> X-Mailer: git-send-email 2.34.1 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" In pvr2_send_request_ex(), when usb_urb_ep_type_check() fails for either the write or read control endpoint, the code returned -EINVAL directly without clearing the corresponding pending flags (ctl_write_pend_flag or ctl_read_pend_flag) or going through the done: cleanup path. This left the pending flags set while the URBs were never actually submitted. On the next call to pvr2_send_request_ex(), the URBs would be filled and submitted while the kernel still considered them active, triggering the WARNING "URB submitted while active" in usb_submit_urb(). Fix this by: - Clearing the pending flag before returning on invalid endpoint - Using goto done instead of direct return to go through proper cleanup - For the read endpoint case, unlinking the write URB if it was already submitted and waiting for its completion before returning Reported-by: syzbot+20fef510634faf733060@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=3D20fef510634faf733060 Signed-off-by: Nguyen Quang Le Kien --- drivers/media/usb/pvrusb2/pvrusb2-hdw.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/drivers/media/usb/pvrusb2/pvrusb2-hdw.c b/drivers/media/usb/pv= rusb2/pvrusb2-hdw.c index 3c270ef00..3a857e95b 100644 --- a/drivers/media/usb/pvrusb2/pvrusb2-hdw.c +++ b/drivers/media/usb/pvrusb2/pvrusb2-hdw.c @@ -3669,7 +3669,9 @@ static int pvr2_send_request_ex(struct pvr2_hdw *hdw, pvr2_trace( PVR2_TRACE_ERROR_LEGS, "Invalid write control endpoint"); - return -EINVAL; + hdw->ctl_write_pend_flag =3D 0; + status =3D -EINVAL; + goto done; } status =3D usb_submit_urb(hdw->ctl_write_urb,GFP_KERNEL); if (status < 0) { @@ -3699,7 +3701,13 @@ status); pvr2_trace( PVR2_TRACE_ERROR_LEGS, "Invalid read control endpoint"); - return -EINVAL; + hdw->ctl_read_pend_flag =3D 0; + status =3D -EINVAL; + if (hdw->ctl_write_pend_flag) { + usb_unlink_urb(hdw->ctl_write_urb); + wait_for_completion(&hdw->ctl_done); + } + goto done; } status =3D usb_submit_urb(hdw->ctl_read_urb,GFP_KERNEL); if (status < 0) { --=20 2.34.1