NoaSoftware
/
TencentOS-kernel
forked from TencentOS/TencentOS-kernel
0
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity
2,524 Commits 59 Branches 0 Tags 1.5 GiB
C 97.1%
Assembly 1.6%
C++ 0.6%
Makefile 0.3%
Perl 0.1%
Go to file
Tom Rix 88d55cdf7a USB: c67x00: fix use after free in c67x00_giveback_urb 
commit 211f08347355cba1f769bbf3355816a12b3ddd55 upstream.

clang static analysis flags this error

c67x00-sched.c:489:55: warning: Use of memory after it is freed [unix.Malloc]
        usb_hcd_giveback_urb(c67x00_hcd_to_hcd(c67x00), urb, urbp->status);
                                                             ^~~~~~~~~~~~
Problem happens in this block of code

	c67x00_release_urb(c67x00, urb);
	usb_hcd_unlink_urb_from_ep(c67x00_hcd_to_hcd(c67x00), urb);
	spin_unlock(&c67x00->lock);
	usb_hcd_giveback_urb(c67x00_hcd_to_hcd(c67x00), urb, urbp->status);

In the call to c67x00_release_urb has this freeing of urbp

	urbp = urb->hcpriv;
	urb->hcpriv = NULL;
	list_del(&urbp->hep_node);
	kfree(urbp);

And so urbp is freed before usb_hcd_giveback_urb uses it as its 3rd
parameter.

Since all is required is the status, pass the status directly as is
done in c64x00_urb_dequeue

Fixes: e9b29ffc519b ("USB: add Cypress c67x00 OTG controller HCD driver")
Signed-off-by: Tom Rix <trix@redhat.com>
Cc: stable <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20200708131243.24336-1-trix@redhat.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 		2021-03-16 16:32:07 +08:00
Documentation doc: dt: bindings: usb: dwc3: Update entries for disabling SS instances in park mode 2021-03-16 16:31:55 +08:00
LICENSES Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
arch arm: dts: mt7623: add phy-mode property for gmac2 2021-03-16 16:32:01 +08:00
block blk-mq-debugfs: update blk_queue_flag_name[] accordingly for new flags 2021-03-16 16:31:47 +08:00
certs Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
crypto keys: asymmetric: fix error return code in software_key_query() 2021-03-16 16:32:01 +08:00
drivers USB: c67x00: fix use after free in c67x00_giveback_urb 2021-03-16 16:32:07 +08:00
fs fuse: don't ignore errors from fuse_writepages_fill() 2021-03-16 16:32:00 +08:00
include bus: ti-sysc: Handle module unlock quirk needed for some RTC 2021-03-16 16:31:54 +08:00
init x86: Fix early boot crash on gcc-10, third try 2021-03-16 16:28:02 +08:00
ipc ipc/util.c: sysvipc_find_ipc() incorrectly updates position index 2021-03-16 16:27:51 +08:00
kernel cgroup: fix cgroup_sk_alloc() for sk_clone_lock() 2021-03-16 16:31:45 +08:00
lib test_objagg: Fix potential memory leak in error handling 2021-03-16 16:31:04 +08:00
mm mm, compaction: make capture control handling safe wrt interrupts 2021-03-16 16:31:23 +08:00
net xprtrdma: fix incorrect header size calculations 2021-03-16 16:32:00 +08:00
package config/arm64: OPEN CONFIG_PSI and phytium configs 2021-03-16 11:02:59 +08:00
samples samples/vfs: avoid warning in statx override 2021-03-16 16:31:20 +08:00
scripts recordmcount: support >64k sections 2021-03-16 16:31:06 +08:00
security apparmor: ensure that dfa state tables have entries 2021-03-16 16:32:02 +08:00
sound ALSA: hda/realtek - Enable Speaker for ASUS UX563 2021-03-16 16:32:07 +08:00
tools perf stat: Zero all the 'ena' and 'run' array slot stats for interval mode 2021-03-16 16:32:02 +08:00
usr Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
virt KVM: arm64: Save the host's PtrAuth keys in non-preemptible context 2021-03-16 16:29:14 +08:00
.clang-format Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
.cocciconfig Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
.get_maintainer.ignore Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
.gitattributes Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
.gitignore Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
COPYING Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
CREDITS Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
Kbuild Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
Kconfig Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
MAINTAINERS Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
Makefile kbuild: force to build vmlinux if CONFIG_MODVERSION=y 2021-03-16 16:29:50 +08:00
README Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
README.md Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
backport_remove_lists.txt Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
tools_key.pub Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00

README.md

Tencent Linux Kernel 4.0