Unverified Commit c201e72d authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!10123 CVE-2022-48838 

Merge Pull Request from: @ci-robot 
 
PR sync from: Yuntao Liu <liuyuntao12@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/5EDSFK2OMWHADYXOTMW5H5NR4XKA7FZF/ 
CVE-2022-48838

Alan Stern (1):
  [Backport] usb: gadget: Fix use-after-free bug by not setting
    udc->dev.driver


-- 
2.34.1
 
https://gitee.com/src-openeuler/kernel/issues/IADGS2 
 
Link:https://gitee.com/openeuler/kernel/pulls/10123

 

Reviewed-by: default avatarZhang Jianhua <chris.zjh@huawei.com>
Reviewed-by: default avatarZhang Changzhong <zhangchangzhong@huawei.com>
Signed-off-by: default avatarZhang Changzhong <zhangchangzhong@huawei.com>
parents 204e69f0 03144756

drivers/usb/gadget/udc/core.c

+0 −3
Original line number Diff line number Diff line
@@ -1299,7 +1299,6 @@ static void usb_gadget_remove_driver(struct usb_udc *udc) 
	usb_gadget_udc_stop(udc);



	udc->driver = NULL;

	udc->dev.driver = NULL;

	udc->gadget->dev.driver = NULL;

}
@@ -1348,7 +1347,6 @@ static int udc_bind_to_driver(struct usb_udc *udc, struct usb_gadget_driver *dri 
			driver->function);



	udc->driver = driver;

	udc->dev.driver = &driver->driver;

	udc->gadget->dev.driver = &driver->driver;



	usb_gadget_udc_set_speed(udc, driver->max_speed);
@@ -1370,7 +1368,6 @@ static int udc_bind_to_driver(struct usb_udc *udc, struct usb_gadget_driver *dri 
		dev_err(&udc->dev, "failed to start %s: %d\n",

			udc->driver->function, ret);

	udc->driver = NULL;

	udc->dev.driver = NULL;

	udc->gadget->dev.driver = NULL;

	return ret;

}