mirror of
https://github.com/torvalds/linux.git
synced 2026-09-27 11:02:03 +02:00
7a8e247dab
The hiface driver uses URBs embedded in struct pcm_urb, and this is basically a buggy implementation nowadays; since a URB is managed with a refcount, this may lead to a UAF when the URB is released asynchronously. For addressing the problem, this patch converts the embedded URBs to ones that are properly allocated via usb_alloc_urb(). The conversion is rather straightforward; pcm_urb.instance became a pointer, assigned/freed via usb_alloc_urb() and usb_free_urb(), and the call with this is corrected accordingly. Along with it, the resource release is done in the common destructor that is called from both at the error path and the disconnect. No functional changes, only compile-tested. Link: https://lore.kernel.org/20260903130757.0668310a.michal.pecio@gmail.com Signed-off-by: Takashi Iwai <tiwai@suse.de> Link: https://patch.msgid.link/20260903160458.1938392-3-tiwai@suse.de |
||
|---|---|---|
| .. | ||
| chip.c | ||
| chip.h | ||
| Makefile | ||
| pcm.c | ||
| pcm.h | ||