linux-kernel - [PATCH 0/2] Fix use after freed situation in UDC core

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20250301003452.2675360-1-quic_wcheng@quicinc.com>
Date: Fri, 28 Feb 2025 16:34:50 -0800
From: Wesley Cheng <quic_wcheng@...cinc.com>
To: <gregkh@...uxfoundation.org>, <Thinh.Nguyen@...opsys.com>
CC: <linux-kernel@...r.kernel.org>, <linux-usb@...r.kernel.org>,
        Wesley Cheng
	<quic_wcheng@...cinc.com>
Subject: [PATCH 0/2] Fix use after freed situation in UDC core

commit 1ff24d40b3c3 ("usb: dwc3: gadget: Fix incorrect UDC state after
manual deconfiguration")

Added a use after freed situation due to the fact that the
usb_gadget_set_state() API queuing asynchronous work to be run at a later
time.  When moving from device to host mode, the UDC is removed, and this
is the condition where this is seen.  Relocate this fix from the DWC3
gadget, and apply it within the UDC core, so that we can properly manage
the gadget->work.  It also makes sense, as during soft disconnection
sequence, the USB link is unavailable, so any UDC should reflect the
proper state.

Wesley Cheng (2):
  Revert "usb: dwc3: gadget: Fix incorrect UDC state after manual
    deconfiguration"
  usb: gadget: udc: Update USB gadget state during soft disconnect

 drivers/usb/dwc3/gadget.c     | 2 --
 drivers/usb/gadget/udc/core.c | 5 ++++-
 2 files changed, 4 insertions(+), 3 deletions(-)