diff options
| author | Alexey Khoroshilov <khoroshilov@ispras.ru> | 2014-08-10 23:35:11 +0700 |
|---|---|---|
| committer | Felipe Balbi <balbi@ti.com> | 2014-08-19 09:21:46 -0500 |
| commit | 4958cf32f66df854b932b601eef2da3f95973339 (patch) | |
| tree | 4e007ad37a752652594d1c549c681b226881ca32 /net/unix/sysctl_net_unix.c | |
| parent | 0c5824083b8ca4aff083dc74024d0bfd46f9da9d (diff) | |
usb: dbgp gadget: fix use after free in dbgp_unbind()
After dbgp_bind()-dbgp_unbind() cycle happens, static variable dbgp
contains pointers to already deallocated memory (dbgp.serial and dbgp.req).
If the next dbgp_bind() fails, for example in usb_ep_alloc_request(),
dbgp_bind() calls dbgp_unbind() on failure path,
and dbgp_unbind() frees dbgp.serial that still stores a pointer
to already deallocated memory.
The patch sets pointers to NULL in dbgp_unbind().
Found by Linux Driver Verification project (linuxtesting.org).
Signed-off-by: Alexey Khoroshilov <khoroshilov@ispras.ru>
Signed-off-by: Felipe Balbi <balbi@ti.com>
Diffstat (limited to 'net/unix/sysctl_net_unix.c')
0 files changed, 0 insertions, 0 deletions