Description
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: fix null pointer dereference in usb_put_function_instance() usb_put_function_instance() attempts to dereference fd inside fi struct to get mod in uvc_alloc_inst() error path. However, fd is not allocated until later in try_get_usb_function_instance() after allocating fi in uvc_alloc_inst() and thus guranteed to be null in error path. Fix this by adding a null check for fi->fd that returns if fd is null.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
0062f6e56f70bd2230ba1ebd1667d1b32a1af3b2 to < 0fc54a00954f9f4c3e3d4ffa64a530685d99a39baffected0062f6e56f70bd2230ba1ebd1667d1b32a1af3b2 to < 6e6736c049683380f5e20becde498986e9293ca4affected0062f6e56f70bd2230ba1ebd1667d1b32a1af3b2 to < 3a9691fff79bcce95338435599df6d3ae433cfdcaffected0062f6e56f70bd2230ba1ebd1667d1b32a1af3b2 to < 7a4f4ca7ff32ae24807c83e2a06d62b13378d53caffected0062f6e56f70bd2230ba1ebd1667d1b32a1af3b2 to < 6ea3a073ca97716d4a73df49a3bec1c3ccf8e2a0affected0062f6e56f70bd2230ba1ebd1667d1b32a1af3b2 to < d3a7fa61997db3bf6dadef4c1bd87a4fa782a817affected0062f6e56f70bd2230ba1ebd1667d1b32a1af3b2 to < 5117f236e9e30744338b425395d55913c4500897affected0062f6e56f70bd2230ba1ebd1667d1b32a1af3b2 to < 6e74ac5c596fd246e37eadfc354567179ccbe9aaaffected
Linux Linux
Default version status: affected
3.9affected0 to < 3.9unaffected5.10.270 to ≤ 5.10.*unaffected5.15.221 to ≤ 5.15.*unaffected6.1.188 to ≤ 6.1.*unaffected6.6.157 to ≤ 6.6.*unaffected6.12.110 to ≤ 6.12.*unaffected6.18.51 to ≤ 6.18.*unaffected7.2.5 to ≤ 7.2.*unaffected7.3 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/0fc54a00954f9f4c3e3d4ffa64a530685d99a39b ↗
- https://git.kernel.org/stable/c/6e6736c049683380f5e20becde498986e9293ca4 ↗
- https://git.kernel.org/stable/c/3a9691fff79bcce95338435599df6d3ae433cfdc ↗
- https://git.kernel.org/stable/c/7a4f4ca7ff32ae24807c83e2a06d62b13378d53c ↗
- https://git.kernel.org/stable/c/6ea3a073ca97716d4a73df49a3bec1c3ccf8e2a0 ↗
- https://git.kernel.org/stable/c/d3a7fa61997db3bf6dadef4c1bd87a4fa782a817 ↗
- https://git.kernel.org/stable/c/5117f236e9e30744338b425395d55913c4500897 ↗
- https://git.kernel.org/stable/c/6e74ac5c596fd246e37eadfc354567179ccbe9aa ↗