Parcourir la source

f_rockusb: Avoid use-after-free in the global pointer variable

In case of usb_add_function() failure the error path has two issues:
 - the potentially allocated structure isn't getting freed
 - the global pointer variable is assigned to garbage

Fix the above mentioned issues by freeing memory and assigning NULL.

Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Andy Shevchenko il y a 3 ans
Parent
commit
ff52577c1b
1 fichiers modifiés avec 2 ajouts et 1 suppressions
  1. 2 1
      drivers/usb/gadget/f_rockusb.c

+ 2 - 1
drivers/usb/gadget/f_rockusb.c

@@ -309,8 +309,9 @@ static int rockusb_add(struct usb_configuration *c)
 
 	status = usb_add_function(c, &f_rkusb->usb_function);
 	if (status) {
+		free(f_rkusb->buf_head);
 		free(f_rkusb);
-		rockusb_func = f_rkusb;
+		rockusb_func = NULL;
 	}
 	return status;
 }