Alan Stern 07f1d9a6b7 USB: gadget: Fix double-free bug in raw_gadget driver ... commit 90bc2af246 upstream. Re-reading a recently merged fix to the raw_gadget driver showed that it inadvertently introduced a double-free bug in a failure pathway. If raw_ioctl_init() encounters an error after the driver ID number has been allocated, it deallocates the ID number before returning. But when dev_free() runs later on, it will then try to deallocate the ID number a second time. Closely related to this issue is another error in the recent fix: The ID number is stored in the raw_dev structure before the code checks to see whether the structure has already been initialized, in which case the new ID number would overwrite the earlier value. The solution to both bugs is to keep the new ID number in a local variable, and store it in the raw_dev structure only after the check for prior initialization. No errors can occur after that point, so the double-free will never happen. Fixes: f2d8c26068 ("usb: gadget: Fix non-unique driver names in raw-gadget driver") CC: Andrey Konovalov <andreyknvl@gmail.com> CC: <stable@vger.kernel.org> Signed-off-by: Alan Stern <stern@rowland.harvard.edu> Link: https://lore.kernel.org/r/YrMrRw5AyIZghN0v@rowland.harvard.edu Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2022-06-29 09:03:27 +02:00
..
function	usb: gadget: u_ether: fix regression in setting fixed MAC address	2022-06-25 15:18:40 +02:00
legacy	USB: gadget: Fix double-free bug in raw_gadget driver	2022-06-29 09:03:27 +02:00
udc	usb: gadget: lpc32xx_udc: Fix refcount leak in lpc32xx_udc_probe	2022-06-22 14:22:03 +02:00
Kconfig	usb: gadget: uvc: add scatter gather support	2021-07-27 15:59:19 +02:00
Makefile	…
composite.c	USB: gadget: validate interface OS descriptor requests	2022-02-16 12:56:35 +01:00
config.c	usb: fix various gadget panics on 10gbps cabling	2021-06-09 10:40:08 +02:00
configfs.c	usb: gadget: configfs: clear deactivation flag in configfs_composite_unbind()	2022-05-09 09:14:29 +02:00
configfs.h	…
epautoconf.c	…
functions.c	…
u_f.c	…
u_f.h	USB: gadget: u_f: Unbreak offset calculation in VLAs	2020-08-27 09:25:06 +02:00
u_os_desc.h	…
usbstring.c	…