In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
usb: gadget: goku_udc: avoid NULL deref of dev->driver in INT_USBRESET log<\/p>\n
goku_irq() handles a number of bus events under a single ep0 path.
\nIt already guards the gadget driver suspend\/resume callbacks against a
\nNULL ->driver:<\/p>\n
\tif (dev->gadget.speed != USB_SPEED_UNKNOWN
\n\t\t\t&& dev->driver
\n\t\t\t&& dev->driver->resume) {
\n\t\tspin_unlock(&dev->lock);
\n\t\tdev->driver->resume(&dev->gadget);
\n\t\t…
\n\t}<\/p>\n
but the very next branch unconditionally dereferences dev->driver
\nwhen an INT_USBRESET arrives:<\/p>\n
\tif (stat & INT_USBRESET) {
\n\t\tACK(INT_USBRESET);
\n\t\tINFO(dev, “USB reset done, gadget %sn”,
\n\t\t\tdev->driver->driver.name);
\n\t}<\/p>\n
If the controller raises INT_USBRESET before any gadget driver has
\nbeen bound (or after one has been unbound), dev->driver is NULL and
\nthe printk dereferences NULL.<\/p>\n
smatch flags the inconsistency:<\/p>\n
drivers\/usb\/gadget\/udc\/goku_udc.c:1618 goku_irq() error:
\n we previously assumed ‘dev->driver’ could be null (see line 1607)<\/p>\n
Fall back to a placeholder when the gadget driver is not bound.<\/p>\n
No functional change while a gadget driver is bound.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
usb: gadget: goku_udc: avoid NULL deref of dev->driver in INT_USBRESET log<\/p>\n
goku_irq() handles a number of bus events under a singl<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-28714","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/28714","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=28714"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=28714"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=28714"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}