mirrors/linux
2
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-08-31 10:31:33 -04:00
Code Issues Packages Projects Releases Wiki Activity

usb: gadget: uvc: fix dangling pointers in uvc_function_bind() and uvc_function_unbind()

Browse Source 
In uvc_function_bind() error path, we use usb_ep_free_request which
uses uvc->control_req but does not set it to NULL afterwards. Thus,
uvc->control_req is a dangling pointer causing a UAF. Also we do not set
the uvc->control_buf pointer to NULL after freeing it, which is another
dangling pointer. Fix it by setting uvc->control_req to NULL after we run
usb_ep_free_request() and uvc->control_buf to NULL after kfree. Do the
same for uvc_function_unbind().

Reported-by: syzbot+de553c19cb054f174a35@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=de553c19cb054f174a35
Fixes: 0f9df93938 ("usb: gadget: uvc: fix error path in uvc_function_bind()")
Fixes: 6d11ed76c4 ("usb: gadget: f_uvc: convert f_uvc to new function interface")
Cc: stable@vger.kernel.org
Signed-off-by: Jeffin Philip <jeffinphilip14@gmail.com>
Link: https://patch.msgid.link/20260813174311.130823-1-jeffinphilip14@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Jeffin Philip
2026-08-13 23:13:11 +05:30
committed by Greg Kroah-Hartman
parent 10ff55ff55
commit bdab560525
1 changed files with 6 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
drivers/usb/gadget/function/f_uvc.c
View File

@@ -889,9 +889,12 @@ uvc_function_bind(struct usb_configuration *c, struct usb_function *f)
v4l2_error:
v4l2_device_unregister(&uvc->v4l2_dev);
error:
if (uvc->control_req)
if (uvc->control_req) {
usb_ep_free_request(cdev->gadget->ep0, uvc->control_req);
uvc->control_req = NULL;
}
kfree(uvc->control_buf);
uvc->control_buf = NULL;
usb_free_all_descriptors(f);
return ret;
@@ -1075,7 +1078,9 @@ static void uvc_function_unbind(struct usb_configuration *c,
uvc->vdev_release_done = NULL;
usb_ep_free_request(cdev->gadget->ep0, uvc->control_req);
uvc->control_req = NULL;
kfree(uvc->control_buf);
uvc->control_buf = NULL;
usb_free_all_descriptors(f);
}