No description
  • C 98.2%
  • Assembly 1%
  • Makefile 0.3%
  • Shell 0.2%
  • Python 0.1%
Find a file
Repository files (latest commit first)
Filename Latest commit message Latest commit date
Yavuz, Tuba 7fafcfdf63 USB: gadget: f_midi: fixing a possible double-free in f_midi
It looks like there is a possibility of a double-free vulnerability on an
error path of the f_midi_set_alt function in the f_midi driver. If the
path is feasible then free_ep_req gets called twice:

         req->complete = f_midi_complete;
         err = usb_ep_queue(midi->out_ep, req, GFP_ATOMIC);
            => ...
             usb_gadget_giveback_request
               =>
                 f_midi_complete (CALLBACK)
                   (inside f_midi_complete, for various cases of status)
                   free_ep_req(ep, req); // first kfree
         if (err) {
                 ERROR(midi, "%s: couldn't enqueue request: %d\n",
                             midi->out_ep->name, err);
                 free_ep_req(midi->out_ep, req); // second kfree
                 return err;
         }

The double-free possibility was introduced with commit ad0d1a058e
("usb: gadget: f_midi: fix leak on failed to enqueue out requests").

Found by MOXCAFE tool.

Signed-off-by: Tuba Yavuz <tuba@ece.ufl.edu>
Fixes: ad0d1a058e ("usb: gadget: f_midi: fix leak on failed to enqueue out requests")
Acked-by: Felipe Balbi <felipe.balbi@linux.intel.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-03-26 11:53:14 +02:00
arch Merge branch 'x86-pti-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip 2018-03-18 12:03:15 -07:00
block
certs
crypto
Documentation usb: core: Add USB_QUIRK_DELAY_CTRL_MSG to usbcore quirks 2018-03-25 12:50:45 +02:00
drivers USB: gadget: f_midi: fixing a possible double-free in f_midi 2018-03-26 11:53:14 +02:00
firmware
fs for-4.16-rc5-tag 2018-03-16 13:37:42 -07:00
include usb: changes for v4.17 merge window 2018-03-23 13:33:09 +01:00
init
ipc
kernel Merge branch 'x86-pti-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip 2018-03-18 12:03:15 -07:00
lib btree: avoid variable-length allocations 2018-03-14 16:55:29 -07:00
LICENSES
mm Revert "mm/page_alloc: fix memmap_init_zone pageblock alignment" 2018-03-14 16:33:28 -07:00
net
samples
scripts
security
sound ASoC: Fixes for v4.16 2018-03-12 17:30:38 +01:00
tools usbip: tools: usbipd: exclude exported devices from exportable device list 2018-03-22 13:08:20 +01:00
usr
virt kvm/arm fixes for 4.16, take 2 2018-03-15 21:45:37 +01:00
.cocciconfig
.get_maintainer.ignore
.gitattributes
.gitignore
.mailmap
COPYING
CREDITS
Kbuild
Kconfig
MAINTAINERS usb: typec: driver for Pericom PI3USB30532 Type-C cross switch 2018-03-22 13:49:28 +01:00
Makefile Linux 4.16-rc6 2018-03-18 17:48:42 -07:00
README

Linux kernel
============

This file was moved to Documentation/admin-guide/README.rst

Please notice that there are several guides for kernel developers and users.
These guides can be rendered in a number of formats, like HTML and PDF.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.

There are various text files in the Documentation/ subdirectory,
several of them using the Restructured Text markup notation.
See Documentation/00-INDEX for a list of what is contained in each file.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.