CVE-2022-50542

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> media: si470x: Fix use-after-free in si470x_int_in_callback()<br /> <br /> syzbot reported use-after-free in si470x_int_in_callback() [1]. This<br /> indicates that urb-&gt;context, which contains struct si470x_device<br /> object, is freed when si470x_int_in_callback() is called.<br /> <br /> The cause of this issue is that si470x_int_in_callback() is called for<br /> freed urb.<br /> <br /> si470x_usb_driver_probe() calls si470x_start_usb(), which then calls<br /> usb_submit_urb() and si470x_start(). If si470x_start_usb() fails,<br /> si470x_usb_driver_probe() doesn&amp;#39;t kill urb, but it just frees struct<br /> si470x_device object, as depicted below:<br /> <br /> si470x_usb_driver_probe()<br /> ...<br /> si470x_start_usb()<br /> ...<br /> usb_submit_urb()<br /> retval = si470x_start()<br /> return retval<br /> if (retval