mirror of
https://github.com/torvalds/linux.git
synced 2025-11-02 01:29:02 +02:00
87c5ff5615
In the __cdnsp_gadget_init() and cdnsp_gadget_exit() functions, the gadget
structure (pdev->gadget) was freed before its endpoints.
The endpoints are linked via the ep_list in the gadget structure.
Freeing the gadget first leaves dangling pointers in the endpoint list.
When the endpoints are subsequently freed, this results in a use-after-free.
Fix:
By separating the usb_del_gadget_udc() operation into distinct "del" and
"put" steps, cdnsp_gadget_free_endpoints() can be executed prior to the
final release of the gadget structure with usb_put_gadget().
A patch similar to bb9c74a5bd14("usb: dwc3: gadget: Free gadget structure
only after freeing endpoints").
Signed-off-by: Chen Yufeng <chenyufeng@iie.ac.cn>
Link: https://lore.kernel.org/r/20250905094842.1232-1-chenyufeng@iie.ac.cn
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
||
|---|---|---|
| .. | ||
| cdns3-debug.h | ||
| cdns3-ep0.c | ||
| cdns3-gadget.c | ||
| cdns3-gadget.h | ||
| cdns3-imx.c | ||
| cdns3-pci-wrap.c | ||
| cdns3-plat.c | ||
| cdns3-starfive.c | ||
| cdns3-ti.c | ||
| cdns3-trace.c | ||
| cdns3-trace.h | ||
| cdnsp-debug.h | ||
| cdnsp-ep0.c | ||
| cdnsp-gadget.c | ||
| cdnsp-gadget.h | ||
| cdnsp-mem.c | ||
| cdnsp-pci.c | ||
| cdnsp-ring.c | ||
| cdnsp-trace.c | ||
| cdnsp-trace.h | ||
| core.c | ||
| core.h | ||
| drd.c | ||
| drd.h | ||
| gadget-export.h | ||
| host-export.h | ||
| host.c | ||
| Kconfig | ||
| Makefile | ||