• Alexey Khoroshilov's avatar
    usb: dbgp gadget: fix use after free in dbgp_unbind() · 4958cf32
    Alexey Khoroshilov authored
    After dbgp_bind()-dbgp_unbind() cycle happens, static variable dbgp
    contains pointers to already deallocated memory (dbgp.serial and dbgp.req).
    If the next dbgp_bind() fails, for example in usb_ep_alloc_request(),
    dbgp_bind() calls dbgp_unbind() on failure path,
    and dbgp_unbind() frees dbgp.serial that still stores a pointer
    to already deallocated memory.
    
    The patch sets pointers to NULL in dbgp_unbind().
    
    Found by Linux Driver Verification project (linuxtesting.org).
    Signed-off-by: default avatarAlexey Khoroshilov <khoroshilov@ispras.ru>
    Signed-off-by: default avatarFelipe Balbi <balbi@ti.com>
    4958cf32
dbgp.c 8.45 KB