Messages in this thread | | | From | Hangyu Hua <> | Subject | [PATCH v4 0/2] usb: gadget: use after free in dev_config | Date | Sat, 1 Jan 2022 01:21:36 +0800 |
| |
There are two bugs: dev->buf does not need to be released if it already exists before executing dev_config. dev->config and dev->hs_config and dev->dev need to be cleaned if dev_config fails to avoid UAF.
v2: 1. break one patch up into two separate patches. 2. use "fail:" to clear all members.
v3: fix a mistake in [PATCH v3 2/2]
v4: avoid multiple unnecessary statement labels in [PATCH v4 2/2]
Hangyu Hua (2): usb: gadget: don't release an existing dev->buf usb: gadget: clear related members when goto fail
drivers/usb/gadget/legacy/inode.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-)
-- 2.25.1
| |