diff options
| author | Andy Shevchenko <andriy.shevchenko@linux.intel.com> | 2020-12-03 18:32:04 +0300 |
|---|---|---|
| committer | Marek Vasut <marex@denx.de> | 2021-01-31 16:08:56 +0300 |
| commit | ff52577c1b5188a5f25bd7d7d41730bb5de4b688 (patch) | |
| tree | cfe5c0a83df3f556b5daf67909e44512fd667eca /drivers/usb/gadget | |
| parent | 0234609d9631652e2faf77e23f332be29570d7d2 (diff) | |
| download | u-boot-ff52577c1b5188a5f25bd7d7d41730bb5de4b688.tar.xz | |
f_rockusb: Avoid use-after-free in the global pointer variable
In case of usb_add_function() failure the error path has two issues:
- the potentially allocated structure isn't getting freed
- the global pointer variable is assigned to garbage
Fix the above mentioned issues by freeing memory and assigning NULL.
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Diffstat (limited to 'drivers/usb/gadget')
| -rw-r--r-- | drivers/usb/gadget/f_rockusb.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/drivers/usb/gadget/f_rockusb.c b/drivers/usb/gadget/f_rockusb.c index 9dd10f9e9a..bd846ce9a7 100644 --- a/drivers/usb/gadget/f_rockusb.c +++ b/drivers/usb/gadget/f_rockusb.c @@ -309,8 +309,9 @@ static int rockusb_add(struct usb_configuration *c) status = usb_add_function(c, &f_rkusb->usb_function); if (status) { + free(f_rkusb->buf_head); free(f_rkusb); - rockusb_func = f_rkusb; + rockusb_func = NULL; } return status; } |