diff options
| author | Jeffin Philip <jeffinphilip14@gmail.com> | 2026-08-13 23:13:11 +0530 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2026-08-14 10:49:48 +0900 |
| commit | bdab5605259ba5d6ff927c1a85cc83eb3ecfdacc (patch) | |
| tree | 3c8d54eff1d02ef947235bd2bd92e4bd34759856 /include | |
| parent | 10ff55ff552b3bf1dadba03fcc430ea205fa2761 (diff) | |
| download | linux-bdab5605259ba5d6ff927c1a85cc83eb3ecfdacc.tar.gz linux-bdab5605259ba5d6ff927c1a85cc83eb3ecfdacc.zip | |
usb: gadget: uvc: fix dangling pointers in uvc_function_bind() and uvc_function_unbind()
In uvc_function_bind() error path, we use usb_ep_free_request which
uses uvc->control_req but does not set it to NULL afterwards. Thus,
uvc->control_req is a dangling pointer causing a UAF. Also we do not set
the uvc->control_buf pointer to NULL after freeing it, which is another
dangling pointer. Fix it by setting uvc->control_req to NULL after we run
usb_ep_free_request() and uvc->control_buf to NULL after kfree. Do the
same for uvc_function_unbind().
Reported-by: syzbot+de553c19cb054f174a35@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=de553c19cb054f174a35
Fixes: 0f9df9393855 ("usb: gadget: uvc: fix error path in uvc_function_bind()")
Fixes: 6d11ed76c45d ("usb: gadget: f_uvc: convert f_uvc to new function interface")
Cc: stable@vger.kernel.org
Signed-off-by: Jeffin Philip <jeffinphilip14@gmail.com>
Link: https://patch.msgid.link/20260813174311.130823-1-jeffinphilip14@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'include')
0 files changed, 0 insertions, 0 deletions