github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-10-28 17:55:02 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph
cabc249e65
linux/drivers/usb/gadget/function
History
Jeffin Philip bdab560525 usb: gadget: uvc: fix dangling pointers in uvc_function_bind() and uvc_function_unbind() 
In uvc_function_bind() error path, we use usb_ep_free_request which
uses uvc->control_req but does not set it to NULL afterwards. Thus,
uvc->control_req is a dangling pointer causing a UAF. Also we do not set
the uvc->control_buf pointer to NULL after freeing it, which is another
dangling pointer. Fix it by setting uvc->control_req to NULL after we run
usb_ep_free_request() and uvc->control_buf to NULL after kfree. Do the
same for uvc_function_unbind().

Reported-by: syzbot+de553c19cb054f174a35@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=de553c19cb054f174a35
Fixes: 0f9df93938 ("usb: gadget: uvc: fix error path in uvc_function_bind()")
Fixes: 6d11ed76c4 ("usb: gadget: f_uvc: convert f_uvc to new function interface")
Cc: stable@vger.kernel.org
Signed-off-by: Jeffin Philip <jeffinphilip14@gmail.com>
Link: https://patch.msgid.link/20260813174311.130823-1-jeffinphilip14@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-08-14 10:49:48 +09:00
..
f_acm.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
f_ecm.c usb: gadget: f_ecm: Fix net_device lifecycle with device_move 2026-03-30 17:19:29 +02:00
f_eem.c usb: gadget: f_eem: Fix net_device lifecycle with device_move 2026-03-30 17:19:29 +02:00
f_fs.c usb: gadget: f_fs: Fix Use-After-Free in AIO error path 2026-08-14 10:48:36 +09:00
f_hid.c usb: gadget: f_hid: fix device reference leak in hidg_alloc() 2026-05-22 10:34:06 +02:00
f_loopback.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
f_mass_storage.c usb: gadget: f_mass_storage: Remove obsolete version log 2026-07-23 10:34:32 +02:00
f_mass_storage.h USB: gadget: fix up const issue with struct usb_function_instance 2025-05-23 12:31:34 +02:00
f_midi.c usb: gadget: f_midi: cancel pending IN work before freeing the midi object 2026-07-13 07:10:11 +02:00
f_midi2.c usb: gadget: midi2: remove default configfs groups on teardown 2026-08-14 10:48:13 +09:00
f_ncm.c usb: gadget: f_ncm: Use unsigned int for ndp_index 2026-08-03 17:23:51 +02:00
f_obex.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
f_phonet.c usb: gadget: f_phonet: fix skb frags[] overflow in pn_rx_complete() 2026-04-07 13:50:34 +02:00
f_printer.c usb: gadget: printer: fix infinite loop in printer_read() 2026-07-13 07:10:11 +02:00
f_rndis.c usb: gadget: f_rndis: Fix net_device lifecycle with device_move 2026-03-30 17:19:29 +02:00
f_serial.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
f_sourcesink.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
f_subset.c usb: gadget: f_subset: Fix net_device lifecycle with device_move 2026-03-30 17:19:29 +02:00
f_tcm.c usb: gadget: f_tcm: keep port count until LUN teardown completes 2026-08-14 10:49:21 +09:00
f_uac1_legacy.c usb: gadget: f_uac1_legacy: remove broken string configfs attributes 2026-07-17 12:33:37 +02:00
f_uac1.c usb: gadget: uac: validate rate list length before storing 2026-07-10 14:58:24 +02:00
f_uac2.c usb: gadget: uac: validate rate list length before storing 2026-07-10 14:58:24 +02:00
f_uvc.c usb: gadget: uvc: fix dangling pointers in uvc_function_bind() and uvc_function_unbind() 2026-08-14 10:49:48 +09:00
f_uvc.h
g_zero.h usb: gadget: f_sourcesink: Support maxburst configurability for bulk endpoints 2026-01-07 16:13:25 +01:00
Makefile
ndis.h
rndis.c usb: gadget: function: rndis: add length check for header 2026-07-08 13:32:16 +02:00
rndis.h
storage_common.c
storage_common.h
tcm.h usb: gadget: f_tcm: synchronize delayed set_alt with teardown 2026-07-13 07:10:11 +02:00
u_audio.c usb: gadget: u_audio: Fix use-after-free on sound card disconnect 2026-08-14 10:49:31 +09:00
u_audio.h
u_ecm.h usb: gadget: f_ecm: Fix net_device lifecycle with device_move 2026-03-30 17:19:29 +02:00
u_eem.h usb: gadget: f_eem: Fix net_device lifecycle with device_move 2026-03-30 17:19:29 +02:00
u_ether_configfs.h Revert "usb: gadget: u_ether: add gether_opts for config caching" 2026-03-11 16:21:16 +01:00
u_ether.c usb: gadget: u_ether: Fix NULL pointer deref in eth_get_drvinfo 2026-03-18 16:16:45 +01:00
u_ether.h usb: gadget: f_ncm: Fix net_device lifecycle with device_move 2026-03-11 16:21:19 +01:00
u_fs.h usb: gadget: f_fs: Introduce rw_proxy file descriptors 2026-07-10 15:00:47 +02:00
u_gether.h usb: gadget: f_subset: Fix net_device lifecycle with device_move 2026-03-30 17:19:29 +02:00
u_hid.h usb: gadget: hid: allow dynamic interval configuration via configfs 2025-05-01 17:30:48 +02:00
u_midi.h usb: gadget: f_midi: allow customizing the USB MIDI interface string through configfs 2025-12-17 14:43:01 +01:00
u_midi2.h
u_ncm.h usb: gadget: u_ncm: Add kernel-doc comments for struct f_ncm_opts 2026-03-30 17:19:29 +02:00
u_phonet.h
u_printer.h
u_rndis.h usb: gadget: f_rndis: Fix net_device lifecycle with device_move 2026-03-30 17:19:29 +02:00
u_serial.c usb: gadget: functionfs: Use safer strscpy() instead of strcpy() 2026-03-11 15:39:04 +01:00
u_serial.h
u_tcm.h
u_uac1_legacy.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
u_uac1_legacy.h usb: gadget: f_uac1_legacy: remove broken string configfs attributes 2026-07-17 12:33:37 +02:00
u_uac1.h
u_uac2.h
u_uvc.h
uac_common.h
uvc_configfs.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
uvc_configfs.h usb: gadget: uvc: Avoid -Wflex-array-member-not-at-end warnings 2025-04-11 16:08:33 +02:00
uvc_queue.c usb: gadget: uvc: retry vb2_reqbufs() with vb_vmalloc_memops if use_sg fail 2026-01-14 16:03:18 +01:00
uvc_queue.h
uvc_trace.c
uvc_trace.h
uvc_v4l2.c usb: gadget: uvc: clamp SEND_RESPONSE length to the response buffer 2026-07-13 07:10:11 +02:00
uvc_v4l2.h
uvc_video.c usb: gadget: uvc: Fix null pointer dereference in uvcg_video_init() 2026-08-14 10:48:08 +09:00
uvc_video.h
uvc.h usb: gadget: uvc: fix NULL pointer dereference during unbind race 2026-03-30 17:04:50 +02:00