mbox series

[v3,0/2] usb: gadget: use after free in dev_config

Message ID 20211230051132.21056-1-hbh25y@gmail.com
Headers show
Series usb: gadget: use after free in dev_config | expand

Message

Hangyu Hua Dec. 30, 2021, 5:11 a.m. UTC 
There are two bugs:
dev->buf does not need to be released if it already exists before
executing dev_config.
dev->config and dev->hs_config and dev->dev need to be cleaned if
dev_config fails to avoid UAF.

v2:
1. break one patch up into two separate patches.
2. use "fail:" to clear all members.

v3:
fix a mistake in [PATCH v3 2/2]

Hangyu Hua (2):
  usb: gadget: don't release an existing dev->buf
  usb: gadget: clear related members when goto fail

 drivers/usb/gadget/legacy/inode.c | 17 +++++++++++++----
 1 file changed, 13 insertions(+), 4 deletions(-)