[PATCH 0/2] media: dvb-usb-v2: fix URB lifecycle on allocation failure

[Chen Changcheng]

Hi,

This series fixes the dvb-usb-v2 stream URB handling when
usb_alloc_urb() fails.

Patch 1 fixes a double free (probe error path) and a use-after-free
(runtime reconfiguration path) caused by the URB allocation error
paths leaving a stale urbs_initialized count covering already freed,
dangling urb_list[] entries.

Patch 2 makes a failed reconfiguration recoverable: the "all fields
are same" early-out in usb_urb_reconfig() is now gated on
urbs_initialized, so the next submission rebuilds the URBs instead of
silently leaving the stream without any submitted URBs.  It depends on
patch 1 (the gate is only meaningful once the allocation error path
resets urbs_initialized to 0).

-----
Chen Changcheng (2):
  media: dvb-usb-v2: fix URB double free and use-after-free on
    allocation failure
  media: dvb-usb-v2: reallocate URBs after a failed reconfiguration

 drivers/media/usb/dvb-usb-v2/usb_urb.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

-- 
2.25.1