Unverified Commit a54e5de9 authored May 13, 2024 by openeuler-ci-bot Committed by Gitee May 13, 2024

!7163 v2 usb: gadget: f_ncm: Fix UAF ncm object at re-bind after usb ep transport error

Merge Pull Request from: @ci-robot 
 
PR sync from: Wei Li <liwei391@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/OAVLSUGDXHT6KZC3SR4DMXOKBGICQBFZ/ 
 
https://gitee.com/src-openeuler/kernel/issues/I9L5KV 
 
Link:https://gitee.com/openeuler/kernel/pulls/7163

 

Reviewed-by: Xie XiuQi <xiexiuqi@huawei.com>
Reviewed-by: Liu YongQiang <liuyongqiang13@huawei.com>
Signed-off-by: Zhang Changzhong <zhangchangzhong@huawei.com>

parents ea0d8b4c 82fc99fe

drivers/usb/gadget/function/f_ncm.c

+2 −2

Original line number	Diff line number	Diff line
		@@ -885,7 +885,7 @@ static int ncm_set_alt(struct usb_function *f, unsigned intf, unsigned alt)
		if (alt > 1)
		goto fail;

		if (ncm->port.in_ep->enabled) {
		if (ncm->netdev) {
		DBG(cdev, "reset ncm\n");
		ncm->timer_stopping = true;
		ncm->netdev = NULL;
		@@ -1322,7 +1322,7 @@ static void ncm_disable(struct usb_function *f)

		DBG(cdev, "ncm deactivated\n");

		if (ncm->port.in_ep->enabled) {
		if (ncm->netdev) {
		ncm->timer_stopping = true;
		ncm->netdev = NULL;
		gether_disconnect(&ncm->port);