mirror of
https://github.com/torvalds/linux.git
synced 2026-09-24 06:24:02 +02:00
dd0eed9e16
gadget_dev_ioctl() reads dev->gadget before acquiring dev->lock, but dev->state is checked after acquiring the lock. Therefore a concurrent bind can change the device state between these operations, which can leave ioctl with a stale NULL gadget pointer and causing a NULL pointer dereference at gadget->ops->ioctl. Read dev->gadget while holding dev->lock so that the gadget pointer and device state are sampled consistently. Cc: stable <stable@kernel.org> Reported-by: Eulgyu Kim <eulgyukim@snu.ac.kr> Link: https://lore.kernel.org/all/20260824113510.1141236-1-jjy600901@snu.ac.kr/ Reported-by: Jaeyoung Chung <jjy600901@snu.ac.kr> Link: https://lore.kernel.org/all/20260824113510.1141236-1-jjy600901@snu.ac.kr/ Signed-off-by: Lovekesh Solanki <lovekeshsolanki00@gmail.com> Reviewed-by: Alan Stern <stern@rowland.harvard.edu> Link: https://patch.msgid.link/20260825171343.459630-1-lovekeshsolanki00@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
||
|---|---|---|
| .. | ||
| acm_ms.c | ||
| audio.c | ||
| cdc2.c | ||
| dbgp.c | ||
| ether.c | ||
| g_ffs.c | ||
| gmidi.c | ||
| hid.c | ||
| inode.c | ||
| Kconfig | ||
| Makefile | ||
| mass_storage.c | ||
| multi.c | ||
| ncm.c | ||
| nokia.c | ||
| printer.c | ||
| raw_gadget.c | ||
| serial.c | ||
| tcm_usb_gadget.c | ||
| webcam.c | ||
| zero.c | ||