github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-09-22 04:34:03 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph
aeb686a98a
linux/drivers/usb/gadget/function
History
Avichal Rakesh aeb686a98a usb: gadget: uvc: Allocate uvc_requests one at a time 
Currently, the uvc gadget driver allocates all uvc_requests as one array
and deallocates them all when the video stream stops. This includes
de-allocating all the usb_requests associated with those uvc_requests.
This can lead to use-after-free issues if any of those de-allocated
usb_requests were still owned by the usb controller.

This patch is 1 of 2 patches addressing the use-after-free issue.
Instead of bulk allocating all uvc_requests as an array, this patch
allocates uvc_requests one at a time, which should allows for similar
granularity when deallocating the uvc_requests. This patch has no
functional changes other than allocating each uvc_request separately,
and similarly freeing each of them separately.

Link: https://lore.kernel.org/7cd81649-2795-45b6-8c10-b7df1055020d@google.com
Reviewed-by: Daniel Scally <dan.scally@ideasonboard.com>
Reviewed-by: Michael Grzeschik <m.grzeschik@pengutronix.de>
Suggested-by: Michael Grzeschik <m.grzeschik@pengutronix.de>
Tested-by: Michael Grzeschik <m.grzeschik@pengutronix.de>
Signed-off-by: Avichal Rakesh <arakesh@google.com>
Link: https://lore.kernel.org/r/20231109004104.3467968-2-arakesh@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-11-23 12:32:44 +00:00
..
f_acm.c usb: gadget: remove max support speed info in bind operation 2023-08-22 14:48:33 +02:00
f_ecm.c usb: gadget: remove max support speed info in bind operation 2023-08-22 14:48:33 +02:00
f_eem.c usb: gadget: remove max support speed info in bind operation 2023-08-22 14:48:33 +02:00
f_fs.c hardening updates for v6.7-rc1 2023-10-30 19:09:55 -10:00
f_hid.c USB: gadget: f_hid: make hidg_class a static const structure 2023-06-20 16:20:48 +02:00
f_loopback.c usb: gadget: remove max support speed info in bind operation 2023-08-22 14:48:33 +02:00
f_mass_storage.c USB: gadget: f_mass_storage: Fix unused variable warning 2023-08-12 10:06:12 +02:00
f_mass_storage.h
f_midi.c usb: gadget: f_midi: Replace strlcpy() with strscpy() 2023-11-22 12:02:53 +00:00
f_midi2.c usb: gadget: unconditionally allocate hs/ss descriptor in bind operation 2023-08-22 14:48:33 +02:00
f_ncm.c usb: gadget: f_ncm: Always set current gadget in ncm_bind() 2023-10-21 12:54:53 +02:00
f_obex.c usb: gadget: remove max support speed info in bind operation 2023-08-22 14:48:33 +02:00
f_phonet.c usb: gadget: f_phonet: Use struct_size() helper in kzalloc() 2022-01-26 14:01:28 +01:00
f_printer.c USB: gadget: f_printer: make usb_gadget_class a static const structure 2023-06-20 16:20:47 +02:00
f_rndis.c usb: gadget: remove max support speed info in bind operation 2023-08-22 14:48:33 +02:00
f_serial.c usb: gadget: remove max support speed info in bind operation 2023-08-22 14:48:33 +02:00
f_sourcesink.c usb: gadget: remove max support speed info in bind operation 2023-08-22 14:48:33 +02:00
f_subset.c usb: gadget: remove max support speed info in bind operation 2023-08-22 14:48:33 +02:00
f_tcm.c scsi: target: Have drivers report if they support direct submissions 2023-10-13 15:53:57 -04:00
f_uac1_legacy.c
f_uac1.c usb: gadget: f_uac1: allow changing interface name via configfs 2022-01-26 14:10:40 +01:00
f_uac2.c usb: gadget: f_uac2: allow changing terminal types through configfs 2023-10-05 09:35:43 +02:00
f_uvc.c usb: gadget: uvc: prevent use of disabled endpoint 2023-11-23 12:32:44 +00:00
f_uvc.h usb: gadget: uvc: prevent use of disabled endpoint 2023-11-23 12:32:44 +00:00
g_zero.h
Makefile usb: gadget: Add support for USB MIDI 2.0 function driver 2023-07-26 06:38:14 +02:00
ndis.h
rndis.c usb: gadget: function: rndis: limit # of RNDIS instances to 1000 2022-08-31 09:07:52 +02:00
rndis.h usb: gadget: rndis: add spinlock for rndis response list 2022-02-24 11:16:57 +01:00
storage_common.c usb: gadget: Use kstrtobool() instead of strtobool() 2022-11-03 23:46:01 +09:00
storage_common.h usb: gadget: f_mass_storage: forced_eject attribute 2022-07-14 16:06:42 +02:00
tcm.h
u_audio.c usb: gadget: u_audio: don't let userspace block driver unbind 2023-03-09 14:56:32 +01:00
u_audio.h usb: gadget: u_audio: Add suspend call 2022-01-26 14:06:09 +01:00
u_ecm.h
u_eem.h
u_ether_configfs.h
u_ether.c usb: gadget: u_ether: Replace netif_stop_queue with netif_device_detach 2023-10-08 07:50:36 +02:00
u_ether.h usb: gadget: add a inline function gether_bitrate() 2023-08-22 14:48:33 +02:00
u_fs.h usb: gadget: ffs: remove ENTER() macro 2023-03-29 08:55:58 +02:00
u_gether.h
u_hid.h usb: gadget: f_hid: optional SETUP/SET_REPORT mode 2021-08-24 15:41:08 +02:00
u_midi.h usb: gadget: function: Fix inconsistent indent 2021-05-10 11:16:10 +02:00
u_midi2.h usb: gadget: midi2: More flexible MIDI 1.0 configuration 2023-07-26 06:38:14 +02:00
u_ncm.h
u_phonet.h usb: gadget: function: Remove unused declarations 2023-08-22 14:45:29 +02:00
u_printer.h
u_rndis.h
u_serial.c tty: make tty_operations::write()'s count size_t 2023-08-11 21:12:46 +02:00
u_serial.h usb: gadget: function: Remove unused declarations 2023-08-22 14:45:29 +02:00
u_tcm.h
u_uac1_legacy.c usb: gadget: Replace runtime->status->state reference to runtime->state 2022-09-27 08:49:52 +02:00
u_uac1_legacy.h
u_uac1.h usb: gadget: f_uac1: allow changing interface name via configfs 2022-01-26 14:10:40 +01:00
u_uac2.h usb: gadget: f_uac2: allow changing terminal types through configfs 2023-10-05 09:35:43 +02:00
u_uvc.h usb: gadget: uvc: Allow linking function to string descs 2023-02-07 08:46:37 +01:00
uac_common.h usb: gadget: u_audio: Support multiple sampling rates 2022-01-26 14:06:08 +01:00
uvc_configfs.c usb: gadget: uvc: Make bmControls attr read/write 2023-03-29 08:51:26 +02:00
uvc_configfs.h usb: gadget: uvc: Allow linking XUs to string descriptors 2023-02-07 08:46:37 +01:00
uvc_queue.c Revert "usb: gadget: uvc: limit isoc_sg to super speed gadgets" 2022-10-26 14:09:06 +02:00
uvc_queue.h usb: gadget: uvc: rework uvcg_queue_next_buffer to uvcg_complete_buffer 2022-04-21 18:15:33 +02:00
uvc_v4l2.c usb: gadget: uvc: prevent use of disabled endpoint 2023-11-23 12:32:44 +00:00
uvc_v4l2.h
uvc_video.c usb: gadget: uvc: Allocate uvc_requests one at a time 2023-11-23 12:32:44 +00:00
uvc_video.h usb: gadget: uvc: consistently use define for headerlen 2021-10-21 12:53:31 +02:00
uvc.h usb: gadget: uvc: Allocate uvc_requests one at a time 2023-11-23 12:32:44 +00:00