On Thu, Dec 30, 2021 at 02:46:00PM -0500, Alan Stern wrote:

On Thu, Dec 30, 2021 at 01:11:32PM +0800, Hangyu Hua wrote:

quoted

dev->config and dev->hs_config and dev->dev need to be cleaned if
dev_config fails to avoid UAF.

quoted

@@ -1875,6 +1875,9 @@ dev_config (struct file *fd, const char __user *buf, size_t len, loff_t *ptr)
 
 	value = usb_gadget_probe_driver(&gadgetfs_driver);
 	if (value != 0) {
+		dev->dev = NULL;
+		dev->hs_config = NULL;
+		dev->config = NULL;
 		kfree (dev->buf);
 		dev->buf = NULL;

Why not just grep the lock and goto fail?

Wrong word: I meant to write "grab", not "grep".

Alan Stern