From mboxrd@z Thu Jan 1 00:00:00 1970 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: base64 Subject: USB: UDC core: fix double-free in usb_add_gadget_udc_release From: Peter Chen Message-Id: <20180104012725.GA31267@b29397-desktop> Date: Thu, 4 Jan 2018 09:27:25 +0800 To: Alan Stern Cc: Felipe Balbi , Fengguang Wu , USB list List-ID: T24gV2VkLCBKYW4gMDMsIDIwMTggYXQgMTI6NTE6NTFQTSAtMDUwMCwgQWxhbiBTdGVybiB3cm90 ZToKPiBUaGUgZXJyb3ItaGFuZGxpbmcgcGF0aHdheXMgaW4gdXNiX2FkZF9nYWRnZXRfdWRjX3Jl bGVhc2UoKSBhcmUgbWVzc2VkCj4gdXAuICBBc2lkZSBmcm9tIHRoZSB1bmluZm9ybWF0aXZlIHN0 YXRlbWVudCBsYWJlbHMsIHRoZXkgY2FuIGRlYWxsb2NhdGUKPiB0aGUgdWRjIHN0cnVjdHVyZSBh ZnRlciBjYWxsaW5nIHB1dF9kZXZpY2UoKSwgd2hpY2ggaXMgYSBkb3VibGUtZnJlZS4KPiBUaGlz IHdhcyBvYnNlcnZlZCBieSBLQVNBTiBpbiBhdXRvbWF0aWMgdGVzdGluZy4KPiAKPiBUaGlzIHBh dGNoIGNsZWFucyB1cCB0aGUgcm91dGluZS4gIEl0IHByZXNlcnZlcyB0aGUgcmVxdWlyZW1lbnQg dGhhdAo+IHdoZW4gYW55IGZhaWx1cmUgb2NjdXJzLCB3ZSBjYWxsIHB1dF9kZXZpY2UoJmdhZGdl dC0+ZGV2KS4KPiAKPiBTaWduZWQtb2ZmLWJ5OiBBbGFuIFN0ZXJuIDxzdGVybkByb3dsYW5kLmhh cnZhcmQuZWR1Pgo+IFJlcG9ydGVkLWJ5OiBGZW5nZ3VhbmcgV3UgPGZlbmdndWFuZy53dUBpbnRl bC5jb20+Cj4gQ0M6IDxzdGFibGVAdmdlci5rZXJuZWwub3JnPgo+IAo+IC0tLQo+IAo+IE5vdCBo YXZpbmcgcmVjZWl2ZWQgYW55IGZlZWRiYWNrIG9uIHRoaXMgcGF0Y2ggZm9yIGEgd2hpbGUsIEkg aGF2ZSAKPiBkZWNpZGVkIHRvIHN1Ym1pdCBpdC4gIFRoZSBwcm9ibGVtIGl0IGZpeGVzIGlzIHF1 aXRlIG9idmlvdXNseSBhIHJlYWwgCj4gb25lLCB3aGVuIHlvdSBsb29rIGF0IHRoZSBleGlzdGlu ZyBjb2RlLgo+IAo+IEFsYW4gU3Rlcm4KPiAKPiAKPiBbYXMxODU2XQo+IAo+IAo+ICBkcml2ZXJz L3VzYi9nYWRnZXQvdWRjL2NvcmUuYyB8ICAgMjggKysrKysrKysrKysrKy0tLS0tLS0tLS0tLS0t LQo+ICAxIGZpbGUgY2hhbmdlZCwgMTMgaW5zZXJ0aW9ucygrKSwgMTUgZGVsZXRpb25zKC0pCj4g Cj4gSW5kZXg6IHVzYi00LngvZHJpdmVycy91c2IvZ2FkZ2V0L3VkYy9jb3JlLmMKPiA9PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09Cj4gLS0tIHVzYi00Lngub3JpZy9kcml2ZXJzL3VzYi9nYWRnZXQvdWRjL2NvcmUuYwo+ICsr KyB1c2ItNC54L2RyaXZlcnMvdXNiL2dhZGdldC91ZGMvY29yZS5jCj4gQEAgLTExNDcsMTEgKzEx NDcsNyBAQCBpbnQgdXNiX2FkZF9nYWRnZXRfdWRjX3JlbGVhc2Uoc3RydWN0IGRlCj4gIAo+ICAJ dWRjID0ga3phbGxvYyhzaXplb2YoKnVkYyksIEdGUF9LRVJORUwpOwo+ICAJaWYgKCF1ZGMpCj4g LQkJZ290byBlcnIxOwo+IC0KPiAtCXJldCA9IGRldmljZV9hZGQoJmdhZGdldC0+ZGV2KTsKPiAt CWlmIChyZXQpCj4gLQkJZ290byBlcnIyOwo+ICsJCWdvdG8gZXJyX3B1dF9nYWRnZXQ7Cj4gIAo+ ICAJZGV2aWNlX2luaXRpYWxpemUoJnVkYy0+ZGV2KTsKPiAgCXVkYy0+ZGV2LnJlbGVhc2UgPSB1 c2JfdWRjX3JlbGVhc2U7Cj4gQEAgLTExNjAsNyArMTE1NiwxMSBAQCBpbnQgdXNiX2FkZF9nYWRn ZXRfdWRjX3JlbGVhc2Uoc3RydWN0IGRlCj4gIAl1ZGMtPmRldi5wYXJlbnQgPSBwYXJlbnQ7Cj4g IAlyZXQgPSBkZXZfc2V0X25hbWUoJnVkYy0+ZGV2LCAiJXMiLCBrb2JqZWN0X25hbWUoJnBhcmVu dC0+a29iaikpOwo+ICAJaWYgKHJldCkKPiAtCQlnb3RvIGVycjM7Cj4gKwkJZ290byBlcnJfcHV0 X3VkYzsKPiArCj4gKwlyZXQgPSBkZXZpY2VfYWRkKCZnYWRnZXQtPmRldik7Cj4gKwlpZiAocmV0 KQo+ICsJCWdvdG8gZXJyX3B1dF91ZGM7Cj4gIAo+ICAJdWRjLT5nYWRnZXQgPSBnYWRnZXQ7Cj4g IAlnYWRnZXQtPnVkYyA9IHVkYzsKPiBAQCAtMTE3MCw3ICsxMTcwLDcgQEAgaW50IHVzYl9hZGRf Z2FkZ2V0X3VkY19yZWxlYXNlKHN0cnVjdCBkZQo+ICAKPiAgCXJldCA9IGRldmljZV9hZGQoJnVk Yy0+ZGV2KTsKPiAgCWlmIChyZXQpCj4gLQkJZ290byBlcnI0Owo+ICsJCWdvdG8gZXJyX3VubGlz dF91ZGM7Cj4gIAo+ICAJdXNiX2dhZGdldF9zZXRfc3RhdGUoZ2FkZ2V0LCBVU0JfU1RBVEVfTk9U QVRUQUNIRUQpOwo+ICAJdWRjLT52YnVzID0gdHJ1ZTsKPiBAQCAtMTE3OCwyNyArMTE3OCwyNSBA QCBpbnQgdXNiX2FkZF9nYWRnZXRfdWRjX3JlbGVhc2Uoc3RydWN0IGRlCj4gIAkvKiBwaWNrIHVw IG9uZSBvZiBwZW5kaW5nIGdhZGdldCBkcml2ZXJzICovCj4gIAlyZXQgPSBjaGVja19wZW5kaW5n X2dhZGdldF9kcml2ZXJzKHVkYyk7Cj4gIAlpZiAocmV0KQo+IC0JCWdvdG8gZXJyNTsKPiArCQln b3RvIGVycl9kZWxfdWRjOwo+ICAKPiAgCW11dGV4X3VubG9jaygmdWRjX2xvY2spOwo+ICAKPiAg CXJldHVybiAwOwo+ICAKPiAtZXJyNToKPiArIGVycl9kZWxfdWRjOgo+ICAJZGV2aWNlX2RlbCgm dWRjLT5kZXYpOwo+ICAKPiAtZXJyNDoKPiArIGVycl91bmxpc3RfdWRjOgo+ICAJbGlzdF9kZWwo JnVkYy0+bGlzdCk7Cj4gIAltdXRleF91bmxvY2soJnVkY19sb2NrKTsKPiAgCj4gLWVycjM6Cj4g LQlwdXRfZGV2aWNlKCZ1ZGMtPmRldik7Cj4gIAlkZXZpY2VfZGVsKCZnYWRnZXQtPmRldik7Cj4g IAo+IC1lcnIyOgo+IC0Ja2ZyZWUodWRjKTsKPiArIGVycl9wdXRfdWRjOgo+ICsJcHV0X2Rldmlj ZSgmdWRjLT5kZXYpOwo+ICAKPiAtZXJyMToKPiArIGVycl9wdXRfZ2FkZ2V0Ogo+ICAJcHV0X2Rl dmljZSgmZ2FkZ2V0LT5kZXYpOwo+ICAJcmV0dXJuIHJldDsKPiAgfQo+IAoKUmV2aWV3ZWQtYnk6 IFBldGVyIENoZW4gPHBldGVyLmNoZW5AbnhwLmNvbT4K