| commit | 4958cf32f66df854b932b601eef2da3f95973339 | |
| author | Alexey Khoroshilov <khoroshilov@ispras.ru> | |
| Sun, 10 Aug 2014 16:35:11 +0000 (10 23:35 +0700) | ||
| committer | Felipe Balbi <balbi@ti.com> | |
| Tue, 19 Aug 2014 14:21:46 +0000 (19 09:21 -0500) | ||
| tree | 4e007ad37a752652594d1c549c681b226881ca32 | treesnapshot (tar.gz zip) |
| parent | 0c5824083b8ca4aff083dc74024d0bfd46f9da9d | commitdiff |
usb: dbgp gadget: fix use after free in dbgp_unbind()
After dbgp_bind()-dbgp_unbind() cycle happens, static variable dbgp
contains pointers to already deallocated memory (dbgp.serial and dbgp.req).
If the next dbgp_bind() fails, for example in usb_ep_alloc_request(),
dbgp_bind() calls dbgp_unbind() on failure path,
and dbgp_unbind() frees dbgp.serial that still stores a pointer
to already deallocated memory.
The patch sets pointers to NULL in dbgp_unbind().
Found by Linux Driver Verification project (linuxtesting.org).
Signed-off-by: Alexey Khoroshilov <khoroshilov@ispras.ru>
Signed-off-by: Felipe Balbi <balbi@ti.com>
After dbgp_bind()-dbgp_unbind() cycle happens, static variable dbgp
contains pointers to already deallocated memory (dbgp.serial and dbgp.req).
If the next dbgp_bind() fails, for example in usb_ep_alloc_request(),
dbgp_bind() calls dbgp_unbind() on failure path,
and dbgp_unbind() frees dbgp.serial that still stores a pointer
to already deallocated memory.
The patch sets pointers to NULL in dbgp_unbind().
Found by Linux Driver Verification project (linuxtesting.org).
Signed-off-by: Alexey Khoroshilov <khoroshilov@ispras.ru>
Signed-off-by: Felipe Balbi <balbi@ti.com>
| drivers/usb/gadget/legacy/dbgp.c | diffblobblamehistory |