Patch "usb: gadget: u_audio: Clear uac pointer when freed." has been added to the 5.4-stable tree

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



This is a note to let you know that I've just added the patch titled

    usb: gadget: u_audio: Clear uac pointer when freed.

to the 5.4-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     usb-gadget-u_audio-clear-uac-pointer-when-freed.patch
and it can be found in the queue-5.4 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 059c4da064ad5a2cfe6a00779a97052d8cb37bd4
Author: Chris Wulff <Chris.Wulff@xxxxxxxxx>
Date:   Thu Apr 25 15:20:20 2024 +0000

    usb: gadget: u_audio: Clear uac pointer when freed.
    
    [ Upstream commit a2cf936ebef291ef7395172b9e2f624779fb6dc0 ]
    
    This prevents use of a stale pointer if functions are called after
    g_cleanup that shouldn't be. This doesn't fix any races, but converts
    a possibly silent kernel memory corruption into an obvious NULL pointer
    dereference report.
    
    Fixes: eb9fecb9e69b ("usb: gadget: f_uac2: split out audio core")
    Signed-off-by: Chris Wulff <chris.wulff@xxxxxxxxx>
    Link: https://lore.kernel.org/stable/CO1PR17MB54194226DA08BFC9EBD8C163E1172%40CO1PR17MB5419.namprd17.prod.outlook.com
    Link: https://lore.kernel.org/r/CO1PR17MB54194226DA08BFC9EBD8C163E1172@xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
    Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/usb/gadget/function/u_audio.c b/drivers/usb/gadget/function/u_audio.c
index 53b30de16a896..994316d51a0e1 100644
--- a/drivers/usb/gadget/function/u_audio.c
+++ b/drivers/usb/gadget/function/u_audio.c
@@ -624,6 +624,8 @@ void g_audio_cleanup(struct g_audio *g_audio)
 		return;
 
 	uac = g_audio->uac;
+	g_audio->uac = NULL;
+
 	card = uac->card;
 	if (card)
 		snd_card_free_when_closed(card);




[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Index of Archives]     [Linux USB Devel]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]

  Powered by Linux