| commit | 0eccbfbc3078d4dbb981e0f6b78846eeedd2613b | |
| author | Alan Stern <stern@rowland.harvard.edu> | |
| Fri, 24 Mar 2017 17:38:28 +0000 (24 13:38 -0400) | ||
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | |
| Tue, 18 Apr 2017 05:55:54 +0000 (18 07:55 +0200) | ||
| tree | e74cf4646a2e39130114eb5febb6074698744f81 | treesnapshot (tar.gz zip) |
| parent | 21fd1700aa0e18121d55c13039566af95d51a95a | commitdiff |
USB: fix linked-list corruption in rh_call_control()
commit 1633682053a7ee8058e10c76722b9b28e97fb73f upstream.
Using KASAN, Dmitry found a bug in the rh_call_control() routine: If
buffer allocation fails, the routine returns immediately without
unlinking its URB from the control endpoint, eventually leading to
linked-list corruption.
This patch fixes the problem by jumping to the end of the routine
(where the URB is unlinked) when an allocation failure occurs.
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Reported-and-tested-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 1633682053a7ee8058e10c76722b9b28e97fb73f upstream.
Using KASAN, Dmitry found a bug in the rh_call_control() routine: If
buffer allocation fails, the routine returns immediately without
unlinking its URB from the control endpoint, eventually leading to
linked-list corruption.
This patch fixes the problem by jumping to the end of the routine
(where the URB is unlinked) when an allocation failure occurs.
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Reported-and-tested-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| drivers/usb/core/hcd.c | diffblobblamehistory |