Description
In the Linux kernel, the following vulnerability has been resolved: media: video-i2c: fix kthread error pointer left in kthread_vid_cap on failure kthread_run() returns an ERR_PTR on failure, not NULL. When start_streaming() fails, data->kthread_vid_cap is left holding this error pointer instead of being cleared. This causes two subsequent bugs: 1. A future call to start_streaming() sees a non-NULL kthread_vid_cap and returns 0 (success) immediately, without actually starting the capture thread. 2. A call to stop_streaming() checks 'kthread_vid_cap == NULL' which is false for an error pointer, and proceeds to call kthread_stop() on the error pointer, leading to a kernel crash. Fix this by resetting kthread_vid_cap to NULL on failure before jumping to the error path.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
5cebaac609744414463d1ecc28fdecd26c1b9bc1 to < db0f4531aa55cfb0171684ebfffe3ff04b79d5a8affected5cebaac609744414463d1ecc28fdecd26c1b9bc1 to < 0fac63cac6689588da530764ccb6ba55ee8e4d8baffected5cebaac609744414463d1ecc28fdecd26c1b9bc1 to < 5c35d380bea60503c4fe0986fe1de6a3263282b3affected5cebaac609744414463d1ecc28fdecd26c1b9bc1 to < 3d1b10d81fe54852ed953f4129577b733bbd6907affected5cebaac609744414463d1ecc28fdecd26c1b9bc1 to < 968c5213e34c48d35febdfd09cf3dc58ad039140affected5cebaac609744414463d1ecc28fdecd26c1b9bc1 to < 52fd9d80c0cea7bf09e7ee36cad316e5c39b7fe6affected5cebaac609744414463d1ecc28fdecd26c1b9bc1 to < 0e7f2cd72a4f9268ee09a13b13f3339e7cc71557affected5cebaac609744414463d1ecc28fdecd26c1b9bc1 to < 76e379754ba618989f6215be608d5c04774a611daffected
Linux Linux
Default version status: affected
4.18affected0 to < 4.18unaffected5.10.270 to ≤ 5.10.*unaffected5.15.221 to ≤ 5.15.*unaffected6.1.188 to ≤ 6.1.*unaffected6.6.157 to ≤ 6.6.*unaffected6.12.110 to ≤ 6.12.*unaffected6.18.51 to ≤ 6.18.*unaffected7.2.5 to ≤ 7.2.*unaffected7.3 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/db0f4531aa55cfb0171684ebfffe3ff04b79d5a8 ↗
- https://git.kernel.org/stable/c/0fac63cac6689588da530764ccb6ba55ee8e4d8b ↗
- https://git.kernel.org/stable/c/5c35d380bea60503c4fe0986fe1de6a3263282b3 ↗
- https://git.kernel.org/stable/c/3d1b10d81fe54852ed953f4129577b733bbd6907 ↗
- https://git.kernel.org/stable/c/968c5213e34c48d35febdfd09cf3dc58ad039140 ↗
- https://git.kernel.org/stable/c/52fd9d80c0cea7bf09e7ee36cad316e5c39b7fe6 ↗
- https://git.kernel.org/stable/c/0e7f2cd72a4f9268ee09a13b13f3339e7cc71557 ↗
- https://git.kernel.org/stable/c/76e379754ba618989f6215be608d5c04774a611d ↗