1
0
Fork 0
mirror of synced 2025-03-06 20:59:54 +01:00
linux/drivers/usb/gadget
Alan Stern 90bc2af246 USB: gadget: Fix double-free bug in raw_gadget driver
Re-reading a recently merged fix to the raw_gadget driver showed that
it inadvertently introduced a double-free bug in a failure pathway.
If raw_ioctl_init() encounters an error after the driver ID number has
been allocated, it deallocates the ID number before returning.  But
when dev_free() runs later on, it will then try to deallocate the ID
number a second time.

Closely related to this issue is another error in the recent fix: The
ID number is stored in the raw_dev structure before the code checks to
see whether the structure has already been initialized, in which case
the new ID number would overwrite the earlier value.

The solution to both bugs is to keep the new ID number in a local
variable, and store it in the raw_dev structure only after the check
for prior initialization.  No errors can occur after that point, so
the double-free will never happen.

Fixes: f2d8c26068 ("usb: gadget: Fix non-unique driver names in raw-gadget driver")
CC: Andrey Konovalov <andreyknvl@gmail.com>
CC: <stable@vger.kernel.org>
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Link: https://lore.kernel.org/r/YrMrRw5AyIZghN0v@rowland.harvard.edu
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-06-24 13:45:21 +02:00
..
function usb: gadget: uvc: fix list double add in uvcg_video_pump 2022-06-21 16:27:26 +02:00
legacy USB: gadget: Fix double-free bug in raw_gadget driver 2022-06-24 13:45:21 +02:00
udc usb: gadget: lpc32xx_udc: Fix refcount leak in lpc32xx_udc_probe 2022-06-10 11:12:39 +02:00
composite.c USB: gadget: Rename usb_gadget_probe_driver() 2022-04-26 14:00:13 +02:00
config.c usb: fix various gadget panics on 10gbps cabling 2021-06-09 10:40:08 +02:00
configfs.c Linux 5.18-rc5 2022-05-03 16:35:26 +02:00
configfs.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
epautoconf.c usb: gadget: fix for a typo that conveys logically-inverted information. 2021-09-14 10:27:54 +02:00
functions.c USB: add SPDX identifiers to all remaining files in drivers/usb/ 2017-11-04 11:48:02 +01:00
Kconfig media: Kconfig: cleanup VIDEO_DEV dependencies 2022-03-18 05:58:35 +01:00
Makefile usb: gadget: Makefile: remove ccflags-y 2022-03-18 12:56:08 +01:00
u_f.c usb: gadget: Change Andrzej Pietrasiewicz's e-mail address 2019-02-11 11:12:29 +02:00
u_f.h USB: gadget: u_f: Unbreak offset calculation in VLAs 2020-08-27 09:25:06 +02:00
u_os_desc.h usb: gadget: Change Andrzej Pietrasiewicz's e-mail address 2019-02-11 11:12:29 +02:00
usbstring.c usb: gadget: fix langid kernel-doc warning in usbstring.c 2020-07-09 10:13:07 +03:00