kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-18 19:12:56 +00:00
Code Issues Releases Packages Activity
linux/drivers
History
Hemant Kumar ba8ce68307 usb: gadget: Fix double free of device descriptor pointers 
commit 43c4cab006 upstream.

Upon driver unbind usb_free_all_descriptors() function frees all
speed descriptor pointers without setting them to NULL. In case
gadget speed changes (i.e from super speed plus to super speed)
after driver unbind only upto super speed descriptor pointers get
populated. Super speed plus desc still holds the stale (already
freed) pointer. Fix this issue by setting all descriptor pointers
to NULL after freeing them in usb_free_all_descriptors().

Fixes: f5c61225cf ("usb: gadget: Update function for SuperSpeedPlus")
cc: stable@vger.kernel.org
Reviewed-by: Peter Chen <peter.chen@kernel.org>
Signed-off-by: Hemant Kumar <hemantk@codeaurora.org>
Signed-off-by: Wesley Cheng <wcheng@codeaurora.org>
Link: https://lore.kernel.org/r/1619034452-17334-1-git-send-email-wcheng@codeaurora.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
History 2021-05-11 14:47:39 +02:00
..
accessibility speakup: fix uninitialized flush_lock 2020-12-30 11:53:44 +01:00
acpi ACPI: GTDT: Don't corrupt interrupt mappings on watchdow probe failure 2021-05-11 14:47:34 +02:00
amba amba: Fix resource leak for drivers without .remove 2021-03-04 11:38:02 +01:00
android binder: add flag to clear buffer on txn complete 2020-12-30 11:54:09 +01:00
ata ata: ahci: Disable SXS for Hisilicon Kunpeng920 2021-05-11 14:47:26 +02:00
atm atm: idt77252: fix null-ptr-dereference 2021-03-30 14:31:50 +02:00
auxdisplay auxdisplay: ht16k33: Fix refresh rate handling 2021-03-04 11:38:00 +01:00
base driver core: Fix locking bug in deferred_probe_timeout_work_func() 2021-04-14 08:42:03 +02:00
bcma bcma: use semicolons rather than commas to separate statements 2020-10-01 16:23:50 +03:00
block block/rnbd-clt: Fix missing a memory free when unloading the module 2021-05-11 14:47:31 +02:00
bluetooth Bluetooth: btqca: Add valid le states quirk 2021-03-11 14:17:22 +01:00
bus bus: mhi: core: Clear context for stopped channels from remove() 2021-05-11 14:47:19 +02:00
cdrom gdrom: use bdev_check_media_change 2020-09-10 09:32:31 -06:00
char tpm: vtpm_proxy: Avoid reading host log when using a virtual device 2021-05-11 14:47:35 +02:00
clk clk: socfpga: arria10: Fix memory leak of socfpga_clk on error return 2021-05-11 14:47:28 +02:00
clocksource clocksource/drivers/mxs_timer: Add missing semicolon when DEBUG is defined 2021-03-04 11:37:57 +01:00
connector connector: simplify the return expression of cn_add_callback() 2020-09-21 13:48:29 -07:00
counter counter: stm32-timer-cnt: fix ceiling miss-alignment with reload register 2021-03-25 09:04:16 +01:00
cpufreq cpufreq: blacklist Arm Vexpress platforms in cpufreq-dt-platdev 2021-03-30 14:31:49 +02:00
cpuidle cpuidle: tegra: Fix C7 idling state on Tegra114 2021-05-11 14:47:16 +02:00
crypto crypto: omap-aes - Fix PM reference leak on omap-aes.c 2021-05-11 14:47:21 +02:00
dax device-dax: Fix default return code of range_parse() 2021-03-04 11:38:15 +01:00
dca dca: Use PTR_ERR_OR_ZERO() to simplify code 2020-05-15 16:25:20 +02:00
devfreq PM / devfreq: tegra30: Improve initial hardware resetting 2020-09-29 17:50:10 +09:00
dio maccess: rename probe_kernel_{read,write} to copy_{from,to}_kernel_nofault 2020-06-17 10:57:41 -07:00
dma dmaengine: tegra20: Fix runtime PM imbalance on error 2021-04-28 13:40:01 +02:00
dma-buf dmabuf: fix use-after-free of dmabuf's file->f_inode 2021-01-12 20:18:24 +01:00
edac EDAC/amd64: Do not load on family 0x15, model 0x13 2021-03-07 12:34:08 +01:00
eisa treewide: replace '---help---' in Kconfig files with 'help' 2020-06-14 01:57:21 +09:00
extcon extcon: arizona: Fix various races on driver unbind 2021-05-11 14:47:24 +02:00
firewire firewire: nosy: Fix a use-after-free bug in nosy_ioctl() 2021-04-07 15:00:11 +02:00
firmware efi/libstub: Add $(CLANG_FLAGS) to x86 flags 2021-05-11 14:47:18 +02:00
fpga fpga: dfl: pci: add DID for D5005 PAC cards 2021-05-11 14:47:19 +02:00
fsi fsi: Aspeed: Add mutex to protect HW access 2020-12-30 11:53:46 +01:00
gnss treewide: replace '---help---' in Kconfig files with 'help' 2020-06-14 01:57:21 +09:00
gpio gpio: omap: Save and restore sysconfig 2021-04-28 13:39:59 +02:00
gpu Fix misc new gcc warnings 2021-05-11 14:47:36 +02:00
greybus drivers/greybus: Use kobj_to_dev() 2020-09-04 18:06:01 +02:00
hid HID: wacom: Assign boolean values to a bool variable 2021-04-28 13:40:01 +02:00
hsi HSI: Fix PM usage counter unbalance in ssi_hw_init 2021-03-04 11:37:52 +01:00
hv Drivers: hv: vmbus: Avoid use-after-free in vmbus_onoffer_rescind() 2021-03-04 11:37:46 +01:00
hwmon hwmon: (dell-smm) Add XPS 15 L502X to fan control blacklist 2021-02-26 10:13:00 +01:00
hwspinlock hwspinlock: qcom: Allow mmio usage in addition to syscon 2020-07-13 22:29:28 -07:00
hwtracing intel_th: pci: Add Alder Lake-M support 2021-05-11 14:47:35 +02:00
i2c i2c: designware: Adjust bus_freq_hz when refuse high speed mode set 2021-04-14 08:42:11 +02:00
i3c i3c master: fix missing destroy_workqueue() on error in i3c_master_register 2021-01-06 14:56:53 +01:00
ide ide/falconide: Fix module unload 2021-03-04 11:38:21 +01:00
idle intel_idle: Build fix 2020-12-03 10:00:23 +01:00
iio iio: hid-sensor-temperature: Fix issues of timestamp channel 2021-03-25 09:04:16 +01:00
infiniband RDMA/addr: Be strict with gid size 2021-04-14 08:42:12 +02:00
input Input: ili210x - add missing negation for touch indication on ili210x 2021-05-11 14:47:34 +02:00
interconnect interconnect: core: fix error return code of icc_link_destroy() 2021-04-16 11:43:19 +02:00
iommu iommu/amd: Fix performance counter initialization 2021-03-17 17:06:24 +01:00
ipack treewide: replace '---help---' in Kconfig files with 'help' 2020-06-14 01:57:21 +09:00
irqchip irqchip/gic-v3: Do not enable irqs when handling spurious interrups 2021-05-11 14:47:15 +02:00
isdn mISDN: fix crash in fritzpci 2021-04-10 13:36:08 +02:00
leds leds: trigger: fix potential deadlock with libata 2021-02-03 23:28:41 +01:00
lightnvm lightnvm: fix memory leak when submit fails 2021-01-27 11:55:22 +01:00
macintosh macintosh/adb-iop: Use big-endian autopoll mask 2021-03-04 11:37:42 +01:00
mailbox mailbox: sprd: correct definition of SPRD_OUTBOX_FIFO_FULL 2021-03-04 11:38:15 +01:00
mcb drivers: mcb: use symbol namespaces 2019-11-03 19:54:53 +01:00
md dm raid: fix inconclusive reshape layout on fast raid4/5/6 table reload sequences 2021-05-11 14:47:36 +02:00
media media: venus: hfi_parser: Don't initialize parser on v1 2021-05-11 14:47:39 +02:00
memory memory: ti-aemif: Drop child node when jumping out loop 2021-03-04 11:37:25 +01:00
memstick memstick: r592: Fix error return in r592_probe() 2020-12-30 11:53:34 +01:00
message scsi: mptfusion: Fix null pointer dereferences in mptscsih_remove() 2020-10-26 16:57:18 -04:00
mfd mfd: arizona: Fix rumtime PM imbalance on error 2021-05-11 14:47:31 +02:00
misc mei: me: add Alder Lake P device id. 2021-05-02 11:06:09 +02:00
mmc mmc: sdhci-brcmstb: Remove CQE quirk 2021-05-11 14:47:26 +02:00
most drivers: most: add character device interface driver 2020-09-07 15:16:26 +02:00
mtd mtd: physmap: physmap-bt1-rom: Fix unintentional stack access 2021-05-11 14:47:13 +02:00
mux treewide: Use fallthrough pseudo-keyword 2020-08-23 17:36:59 -05:00
net sfc: farch: fix TX queue lookup in TX event handling 2021-05-11 14:47:36 +02:00
nfc nfc: s3fwrn5: Release the nfc firmware 2020-12-30 11:53:53 +01:00
ntb Bug fixes for v5.10 2020-10-25 11:12:31 -07:00
nubus nubus: Remove cast to void pointer 2019-10-21 09:08:15 +02:00
nvdimm libnvdimm/region: Fix nvdimm_has_flush() to handle ND_REGION_ASYNC 2021-04-21 13:00:55 +02:00
nvme nvmet: return proper error code from discovery ctrl 2021-05-11 14:47:26 +02:00
nvmem nvmem: qcom-spmi-sdam: Fix uninitialized pdev pointer 2021-03-04 11:38:39 +01:00
of of: property: fw_devlink: do not link ".*,nr-gpios" 2021-04-14 08:41:58 +02:00
opp opp: Correct debug message in _opp_add_static_v2() 2021-03-04 11:37:27 +01:00
oprofile module: Fix up module_notifier return values 2020-09-01 09:58:03 +02:00
parisc dma-mapping: split <linux/dma-mapping.h> 2020-10-06 07:07:03 +02:00
parport treewide: Use fallthrough pseudo-keyword 2020-08-23 17:36:59 -05:00
pci PCI: PM: Do not read power state in pci_enable_device_flags() 2021-05-11 14:47:18 +02:00
pcmcia dma-mapping: remove DMA_MASK_NONE 2020-09-25 06:12:15 +02:00
perf perf/arm_pmu_platform: Fix error handling 2021-05-11 14:47:19 +02:00
phy phy: phy-twl4030-usb: Fix possible use-after-free in twl4030_usb_remove() 2021-05-11 14:47:21 +02:00
pinctrl pinctrl: core: Show pin numbers for the controllers with base = 0 2021-04-28 13:39:59 +02:00
platform platform/x86: intel_pmc_core: Don't use global pmcdev in quirks 2021-05-11 14:47:21 +02:00
pnp PNP: fix kernel-doc markups 2020-10-27 19:23:04 +01:00
power power: supply: cpcap-battery: fix invalid usage of list cursor 2021-05-11 14:47:32 +02:00
powercap Merge branch 'turbostat' of git://git.kernel.org/pub/scm/linux/kernel/git/lenb/linux 2020-11-10 10:02:31 -08:00
pps treewide: replace '---help---' in Kconfig files with 'help' 2020-06-14 01:57:21 +09:00
ps3 powerpc/ps3: use dma_mapping_error() 2020-12-30 11:53:53 +01:00
ptp ptp_qoriq: fix overflow in ptp_qoriq_adjfine() u64 calcalation 2021-04-10 13:36:09 +02:00
pwm pwm: iqs620a: Fix overflow and optimize calculations 2021-03-04 11:38:17 +01:00
rapidio rapidio: fix the missed put_device() for rio_mport_add_riodev 2020-10-16 11:11:22 -07:00
ras RAS/CEC: Correct ce_add_elem()'s returned values 2021-04-14 08:42:12 +02:00
regulator regulator: bd9571mwv: Fix AVS and DVFS voltage range 2021-04-14 08:42:05 +02:00
remoteproc remoteproc: qcom: pil_info: avoid 64-bit division 2021-04-14 08:42:05 +02:00
reset ARM: SoC-related driver updates 2020-10-24 10:39:22 -07:00
rpmsg rpmsg updates for 5.10 2020-10-22 12:58:21 -07:00
rtc rtc: zynqmp: depend on HAS_IOMEM 2021-03-04 11:38:03 +01:00
s390 s390/zcrypt: fix zcard and zqueue hot-unplug memleak 2021-05-11 14:47:11 +02:00
sbus treewide: replace '---help---' in Kconfig files with 'help' 2020-06-14 01:57:21 +09:00
scsi scsi: libfc: Fix a format specifier 2021-05-11 14:47:31 +02:00
sfi treewide: replace '---help---' in Kconfig files with 'help' 2020-06-14 01:57:21 +09:00
sh iomap: constify ioreadX() iomem argument (as in generic implementation) 2020-08-14 19:56:57 -07:00
siox siox: Use the correct style for SPDX License Identifier 2020-01-14 21:46:53 +01:00
slimbus slimbus: qcom: fix potential NULL dereference in qcom_slim_prg_slew() 2020-12-30 11:53:47 +01:00
soc soc/tegra: pmc: Fix completion of power-gate toggling 2021-05-11 14:47:18 +02:00
soundwire soundwire: cadence: only prepare attached devices on clock stop 2021-05-11 14:47:19 +02:00
spi spi: sync up initial chipselect state 2021-05-11 14:47:22 +02:00
spmi spmi: spmi-pmic-arb: Fix hw_irq overflow 2021-03-04 11:38:40 +01:00
ssb ssb: Remove meaningless jump label to simplify the code 2020-09-21 16:01:35 +03:00
staging media: staging/intel-ipu3: Fix race condition during set_fmt 2021-05-11 14:47:38 +02:00
target scsi: target: pscsi: Fix warning in pscsi_complete_cmd() 2021-05-11 14:47:23 +02:00
tc The main MIPS changes for 5.6: 2020-01-31 11:28:31 -08:00
tee tee: optee: do not check memref size on return from Secure World 2021-05-11 14:47:18 +02:00
thermal thermal/core: Add NULL pointer check before using cooling device stats 2021-04-07 15:00:06 +02:00
thunderbolt thunderbolt: Fix off by one in tb_port_find_retimer() 2021-04-14 08:42:03 +02:00
tty tty: n_gsm: check error while registering tty devices 2021-05-11 14:47:21 +02:00
uio uio: Fix use-after-free in uio_unregister_device() 2020-11-09 18:54:30 +01:00
usb usb: gadget: Fix double free of device descriptor pointers 2021-05-11 14:47:39 +02:00
vdpa vdpa/mlx5: Set err = -ENOMEM in case dma_map_sg_attrs fails 2021-04-28 13:39:59 +02:00
vfio vfio: Depend on MMU 2021-05-07 11:04:33 +02:00
vhost vhost-vdpa: fix vm_flags for virtqueue doorbell mapping 2021-05-11 14:47:12 +02:00
video backlight: qcom-wled: Fix FSC update issue for WLED5 2021-05-11 14:47:25 +02:00
virt nitro_enclaves: Fix stale file descriptors on failed usercopy 2021-05-11 14:47:11 +02:00
virtio virtio_ring: Fix two use after free bugs 2020-12-30 11:54:00 +01:00
visorbus treewide: replace '---help---' in Kconfig files with 'help' 2020-06-14 01:57:21 +09:00
vlynq treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 102 2019-05-24 17:39:00 +02:00
vme treewide: replace '---help---' in Kconfig files with 'help' 2020-06-14 01:57:21 +09:00
w1 w1: w1_therm: Fix conversion result for negative temperatures 2021-03-04 11:37:18 +01:00
watchdog watchdog: mei_wdt: request stop on unregister 2021-03-04 11:38:36 +01:00
xen xen/events: fix setting irq affinity 2021-04-16 11:43:22 +02:00
zorro zorro: Fix address space collision message with RAM expansion boards 2020-08-26 13:26:52 +02:00
Kconfig virtio: fixes, vdpa 2020-04-08 10:51:53 -07:00
Makefile vdpa: mlx5: fix vdpa/vhost dependencies 2020-12-02 04:09:56 -05:00