On 16.02.24 18:58, zdi-disclosures@xxxxxxxxxxxxxx wrote:
Hi Greg,
Thanks for the update :)
Hi,
does this do the job?
Regards
Oliver
From f7ed821da13fae6c80d65f9c0dba4c926970535e Mon Sep 17 00:00:00 2001
From: Oliver Neukum <oneukum@xxxxxxxx>
Date: Mon, 19 Feb 2024 13:21:44 +0100
Subject: [PATCH] usbip: get new count before dropping the old
Those devices can be identical. In that case dropping
the old reference first leads to a use after free.
Signed-off-by: Oliver Neukum <oneukum@xxxxxxxx>
---
drivers/usb/usbip/vhci_hcd.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/usb/usbip/vhci_hcd.c b/drivers/usb/usbip/vhci_hcd.c
index 82650c11e451..76f629031005 100644
--- a/drivers/usb/usbip/vhci_hcd.c
+++ b/drivers/usb/usbip/vhci_hcd.c
@@ -757,12 +757,13 @@ static int vhci_urb_enqueue(struct usb_hcd *hcd, struct urb *urb, gfp_t mem_flag
switch (ctrlreq->bRequest) {
case USB_REQ_SET_ADDRESS:
+ struct usb_device *ud = vdev->udev;
/* set_address may come when a device is reset */
dev_info(dev, "SetAddress Request (%d) to port %d\n",
ctrlreq->wValue, vdev->rhport);
- usb_put_dev(vdev->udev);
vdev->udev = usb_get_dev(urb->dev);
+ usb_put_dev(ud);
spin_lock(&vdev->ud.lock);
vdev->ud.status = VDEV_ST_USED;
--
2.43.0
