github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-10-28 17:55:02 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph
cabc249e65
linux/drivers/usb/gadget
History
Jeffin Philip bdab560525 usb: gadget: uvc: fix dangling pointers in uvc_function_bind() and uvc_function_unbind() 
In uvc_function_bind() error path, we use usb_ep_free_request which
uses uvc->control_req but does not set it to NULL afterwards. Thus,
uvc->control_req is a dangling pointer causing a UAF. Also we do not set
the uvc->control_buf pointer to NULL after freeing it, which is another
dangling pointer. Fix it by setting uvc->control_req to NULL after we run
usb_ep_free_request() and uvc->control_buf to NULL after kfree. Do the
same for uvc_function_unbind().

Reported-by: syzbot+de553c19cb054f174a35@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=de553c19cb054f174a35
Fixes: 0f9df93938 ("usb: gadget: uvc: fix error path in uvc_function_bind()")
Fixes: 6d11ed76c4 ("usb: gadget: f_uvc: convert f_uvc to new function interface")
Cc: stable@vger.kernel.org
Signed-off-by: Jeffin Philip <jeffinphilip14@gmail.com>
Link: https://patch.msgid.link/20260813174311.130823-1-jeffinphilip14@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-08-14 10:49:48 +09:00
..
function usb: gadget: uvc: fix dangling pointers in uvc_function_bind() and uvc_function_unbind() 2026-08-14 10:49:48 +09:00
legacy USB: gadget: inode: fix mm lifetime handling 2026-07-10 15:55:31 +02:00
udc usb: gadget: snps_udc_plat: clean up PHY on probe deferral 2026-08-14 10:48:50 +09:00
composite.c usb: gadget: composite: fix dead empty check in the USB_DT_OTG handler 2026-06-25 16:03:54 +01:00
config.c usb: gadget: config: Remove unused usb_gadget_config_buf 2025-06-19 12:26:48 +02:00
configfs.c usb: gadget: configfs: fix out-of-bounds read of qw_sign 2026-07-10 15:13:43 +02:00
configfs.h
epautoconf.c usb: gadget: epautoconf: Use USB API functions rather than constants 2025-05-21 13:13:22 +02:00
functions.c
Kconfig usb: gadget: midi2: Reverse-select at the right place 2025-01-07 11:42:22 +01:00
Makefile
u_f.c usb: gadget: function: move u_f.h to include/linux/usb/func_utils.h 2024-09-03 09:57:08 +02:00
u_os_desc.h move asm/unaligned.h to linux/unaligned.h 2024-10-02 17:23:23 -04:00
usbstring.c drivers/usb/gadget: refactor min with min_t 2024-11-13 15:09:50 +01:00