Messages in this thread | | | Date | Fri, 31 Dec 2021 12:35:03 -0500 | From | Alan Stern <> | Subject | Re: [PATCH v4 2/2] usb: gadget: clear related members when goto fail |
| |
On Sat, Jan 01, 2022 at 01:21:38AM +0800, Hangyu Hua wrote: > dev->config and dev->hs_config and dev->dev need to be cleaned if > dev_config fails to avoid UAF. > > Signed-off-by: Hangyu Hua <hbh25y@gmail.com> > ---
Acked-by: Alan Stern <stern@rowland.harvard.edu>
> drivers/usb/gadget/legacy/inode.c | 7 +++++-- > 1 file changed, 5 insertions(+), 2 deletions(-) > > diff --git a/drivers/usb/gadget/legacy/inode.c b/drivers/usb/gadget/legacy/inode.c > index eaad03c0252f..25c8809e0a38 100644 > --- a/drivers/usb/gadget/legacy/inode.c > +++ b/drivers/usb/gadget/legacy/inode.c > @@ -1875,8 +1875,8 @@ dev_config (struct file *fd, const char __user *buf, size_t len, loff_t *ptr) > > value = usb_gadget_probe_driver(&gadgetfs_driver); > if (value != 0) { > - kfree (dev->buf); > - dev->buf = NULL; > + spin_lock_irq(&dev->lock); > + goto fail; > } else { > /* at this point "good" hardware has for the first time > * let the USB the host see us. alternatively, if users > @@ -1893,6 +1893,9 @@ dev_config (struct file *fd, const char __user *buf, size_t len, loff_t *ptr) > return value; > > fail: > + dev->config = NULL; > + dev->hs_config = NULL; > + dev->dev = NULL; > spin_unlock_irq (&dev->lock); > pr_debug ("%s: %s fail %zd, %p\n", shortname, __func__, value, dev); > kfree (dev->buf); > -- > 2.25.1 >
| |