shinys000114/linux
1
0
Fork 0
mirror of https://github.com/hardkernel/linux.git synced 2026-06-08 11:50:43 +09:00
Code Issues Packages Projects Releases Wiki Activity

kasan: fix bug report in xhci driver

Browse Source 
PD#172700

KASAN found a use-after-free in xhci_free_virt_device+0x220/0x270
where xhci_free_virt_device() sets slot id to 0 if udev exists:
if (dev->udev && dev->udev->slot_id)
	dev->udev->slot_id = 0;

dev->udev will be true even if udev is freed because dev->udev is
not set to NULL.

set dev->udev pointer to NULL in xhci_free_dev()

The original patch went to stable so this fix needs to be applied
there as well.

Change-Id: I552b245ac7a047d8190a59bd18876cd650f289a1
Signed-off-by: Yue Wang <yue.wang@amlogic.com>
This commit is contained in:
Yue Wang
2018-09-10 15:04:25 +08:00
committed by Jianxin Pan
parent c0a7f4010b
commit 1fef1fae05
1 changed files with 4 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
drivers/usb/host/xhci.c
View File

@@ -3637,6 +3637,10 @@ void xhci_free_dev(struct usb_hcd *hcd, struct usb_device *udev)
del_timer_sync(&virt_dev->eps[i].stop_cmd_timer);
}
#ifdef CONFIG_AMLOGIC_USB
virt_dev->udev = NULL;
#endif
spin_lock_irqsave(&xhci->lock, flags);
/* Don't disable the slot if the host controller is dead. */
state = readl(&xhci->op_regs->status);