xhci: Fix use-after-free in xhci_free_virt_device
KASAN found a use-after-free in xhci_free_virt_device+0x33b/0x38e where xhci_free_virt_device() sets slot id to 0 if udev exists: if (dev->udev && dev->udev->slot_id) dev->udev->slot_id = 0; dev->udev will be true even if udev is freed because dev->udev is not set to NULL. set dev->udev pointer to NULL in xhci_free_dev() The original patch went to stable so this fix needs to be applied there as well. Fixes: a400efe455f7 ("xhci: zero usb device slot_id member when disabling and freeing a xhci slot") Cc: <stable@vger.kernel.org> Reported-by:Guenter Roeck <linux@roeck-us.net> Reviewed-by:
Guenter Roeck <linux@roeck-us.net> Tested-by:
Guenter Roeck <linux@roeck-us.net> Signed-off-by:
Mathias Nyman <mathias.nyman@linux.intel.com> Signed-off-by:
Greg Kroah-Hartman <gregkh@linuxfoundation.org> Git-commit: 44a182b9d17765514fa2b1cc911e4e65134eef93 Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git [hemantk@codeaurora.org: resolved merge conflict] Signed-off-by:
Hemant Kumar <hemantk@codeaurora.org> Change-Id: I507d8439de007b3df6728f77407a4aee51463913
Loading
Please register or sign in to comment