Alan Stern 67e41b1368 USB: fix linked-list corruption in rh_call_control() ...

commit 1633682053 upstream.

Using KASAN, Dmitry found a bug in the rh_call_control() routine: If
buffer allocation fails, the routine returns immediately without
unlinking its URB from the control endpoint, eventually leading to
linked-list corruption.

This patch fixes the problem by jumping to the end of the routine
(where the URB is unlinked) when an allocation failure occurs.

Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Reported-and-tested-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2017-04-08 09:30:34 +02:00

..

buffer.c

usb: core: buffer: avoid NULL pointer dereferrence

2016-04-28 12:35:36 -07:00

config.c

usb-core: Add LINEAR_FRAME_INTR_BINTERVAL USB quirk

2017-03-30 09:41:24 +02:00

devices.c

usb: core: rename mutex usb_bus_list_lock to usb_bus_idr_lock

2016-02-06 21:55:57 -08:00

devio.c

fs: Replace CURRENT_TIME with current_time() for inode timestamps

2016-09-27 21:06:21 -04:00

driver.c

USB: leave LPM alone if possible when binding/unbinding interface drivers

2016-05-03 14:32:07 -07:00

endpoint.c

usb: endpoint: convert spaces to tabs

2015-08-14 16:50:36 -07:00

file.c

usb: core: use kbasename() instead of open-coded variant

2016-01-24 20:37:47 -08:00

generic.c

staging: usbip: convert usbip-host driver to usb_device_driver

2014-02-07 10:54:30 -08:00

hcd-pci.c

usb: hcd: out of bounds access in for_each_companion

2016-04-13 12:06:18 -07:00

hcd.c

USB: fix linked-list corruption in rh_call_control()

2017-04-08 09:30:34 +02:00

hub.c

usb: hub: Fix crash after failure to read BOS descriptor

2017-03-30 09:41:24 +02:00

hub.h

usb: Support USB 3.1 extended port status request

2016-01-24 20:16:52 -08:00

Kconfig

usb: core: Introduce a USB port LED trigger

2016-09-27 12:20:17 +02:00

ledtrig-usbport.c

usb: core: usbport: Use proper LED API to fix potential crash

2017-01-06 10:40:11 +01:00

Makefile

usb: core: Introduce a USB port LED trigger

2016-09-27 12:20:17 +02:00

message.c

usb: core: setup dma_pfn_offset for USB devices and, interfaces

2016-09-13 17:25:35 +02:00

notify.c

usb: Add export.h for EXPORT_SYMBOL/THIS_MODULE where needed

2011-10-31 19:31:25 -04:00

of.c

usb: core: of.c: fix defined but not declare warning

2016-08-09 16:16:13 +02:00

otg_whitelist.h

usb: core: use IS_ENABLED() instead of checking for built-in or module

2016-09-02 14:36:33 +02:00

port.c

Revert "USB / PM: Allow USB devices to remain runtime-suspended when sleeping"

2016-05-02 08:44:31 -07:00

quirks.c

usb-core: Add LINEAR_FRAME_INTR_BINTERVAL USB quirk

2017-03-30 09:41:24 +02:00

sysfs.c

usb: no locking for reading descriptors in sysfs

2016-02-03 13:29:12 -08:00

urb.c

usb: core: urb: don't print on ENOMEM

2016-08-30 19:17:37 +02:00

usb-acpi.c

usb: find internal hub tier mismatch via acpi

2014-05-27 16:38:52 -07:00

usb.c

usb: core: setup dma_pfn_offset for USB devices and, interfaces

2016-09-13 17:25:35 +02:00

usb.h

usb: define USB_SPEED_SUPER_PLUS speed for SuperSpeedPlus USB3.1 devices

2016-01-24 20:16:52 -08:00