diff options
| author | Alexey Khoroshilov <[email protected]> | 2014-08-10 23:35:11 +0700 |
|---|---|---|
| committer | Felipe Balbi <[email protected]> | 2014-08-19 09:21:46 -0500 |
| commit | 4958cf32f66df854b932b601eef2da3f95973339 (patch) | |
| tree | 4e007ad37a752652594d1c549c681b226881ca32 /tools/perf/scripts/python/Perf-Trace-Util/lib/Perf/Trace/EventClass.py | |
| parent | 0c5824083b8ca4aff083dc74024d0bfd46f9da9d (diff) | |
usb: dbgp gadget: fix use after free in dbgp_unbind()
After dbgp_bind()-dbgp_unbind() cycle happens, static variable dbgp
contains pointers to already deallocated memory (dbgp.serial and dbgp.req).
If the next dbgp_bind() fails, for example in usb_ep_alloc_request(),
dbgp_bind() calls dbgp_unbind() on failure path,
and dbgp_unbind() frees dbgp.serial that still stores a pointer
to already deallocated memory.
The patch sets pointers to NULL in dbgp_unbind().
Found by Linux Driver Verification project (linuxtesting.org).
Signed-off-by: Alexey Khoroshilov <[email protected]>
Signed-off-by: Felipe Balbi <[email protected]>
Diffstat (limited to 'tools/perf/scripts/python/Perf-Trace-Util/lib/Perf/Trace/EventClass.py')
0 files changed, 0 insertions, 0 deletions