Re: ZDI-CAN-22273: New Vulnerability Report

[Oliver Neukum <oneukum@suse.com>]

[-- Attachment #1: Type: text/plain, Size: 144 bytes --]



On 16.02.24 18:58, zdi-disclosures@trendmicro.com wrote:
> Hi Greg,
> Thanks for the update :)

Hi,

does this do the job?

	Regards
		Oliver

[-- Attachment #2: 0001-usbip-get-new-count-before-dropping-the-old.patch --]
[-- Type: text/x-patch, Size: 1168 bytes --]

From f7ed821da13fae6c80d65f9c0dba4c926970535e Mon Sep 17 00:00:00 2001
From: Oliver Neukum <oneukum@suse.com>
Date: Mon, 19 Feb 2024 13:21:44 +0100
Subject: [PATCH] usbip: get new count before dropping the old

Those devices can be identical. In that case dropping
the old reference first leads to a use after free.

Signed-off-by: Oliver Neukum <oneukum@suse.com>
---
 drivers/usb/usbip/vhci_hcd.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/usb/usbip/vhci_hcd.c b/drivers/usb/usbip/vhci_hcd.c
index 82650c11e451..76f629031005 100644
--- a/drivers/usb/usbip/vhci_hcd.c
+++ b/drivers/usb/usbip/vhci_hcd.c
@@ -757,12 +757,13 @@ static int vhci_urb_enqueue(struct usb_hcd *hcd, struct urb *urb, gfp_t mem_flag
 
 		switch (ctrlreq->bRequest) {
 		case USB_REQ_SET_ADDRESS:
+			struct usb_device *ud = vdev->udev;
 			/* set_address may come when a device is reset */
 			dev_info(dev, "SetAddress Request (%d) to port %d\n",
 				 ctrlreq->wValue, vdev->rhport);
 
-			usb_put_dev(vdev->udev);
 			vdev->udev = usb_get_dev(urb->dev);
+			usb_put_dev(ud);
 
 			spin_lock(&vdev->ud.lock);
 			vdev->ud.status = VDEV_ST_USED;
-- 
2.43.0