title: usb: cdns3: fixed memory use after free at cdns3_gadget_ep_disable()
description: In the Linux kernel, the following vulnerability has been resolved:
usb: cdns3: fixed memory use after free at cdns3_gadget_ep_disable()
...
cdns3_gadget_ep_free_request(&priv_ep->endpoint, &priv_req->request);
list_del_init(&priv_req->list);
...
'priv_req' actually free at cdns3_gadget_ep_free_request(). But
list_del_init() use priv_req->list after it.
[ 1542.642868][  T534] BUG: KFENCE: use-after-free read in __list_del_entry_valid+0x10/0xd4
[ 1542.642868][  T534]
[ 1542.653162][  T534] Use-after-free read at 0x000000009ed0ba99 (in kfence-#3):
[ 1542.660311][  T534]  __list_del_entry_valid+0x10/0xd4
[ 1542.665375][  T534]  cdns3_gadget_ep_disable+0x1f8/0x388 [cdns3]
[ 1542.671571][  T534]  usb_ep_disable+0x44/0xe4
[ 1542.675948][  T534]  ffs_func_eps_disable+0x64/0xc8
[ 1542.680839][  T534]  ffs_func_set_alt+0x74/0x368
[ 1542.685478][  T534]  ffs_func_disable+0x18/0x28
Move list_del_init() before cdns3_gadget_ep_free_request() to resolve this
problem.
affected:
{
product: Linux
vendor: Linux
defaultStatus: unaffected
repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
versions:
version: 7733f6c32e36, lessThan: cfa9abb5570c, status: affected, versionType: git
version: 7733f6c32e36, lessThan: b40328eea93c, status: affected, versionType: git
version: 7733f6c32e36, lessThan: 4e5c73b15d95, status: affected, versionType: git
version: 7733f6c32e36, lessThan: 2134e9906e17, status: affected, versionType: git
version: 7733f6c32e36, lessThan: 29e42e1578a1, status: affected, versionType: git
version: 7733f6c32e36, lessThan: 9a07244f614b, status: affected, versionType: git
version: 7733f6c32e36, lessThan: cd45f99034b0, status: affected, versionType: git
}
{
product: Linux
vendor: Linux
defaultStatus: affected
repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
versions:
version: 5.4, status: affected
version: 0, lessThan: 5.4, status: unaffected, versionType: custom
version: 5.4.270, lessThanOrEqual: 5.4.*, status: unaffected, versionType: custom
version: 5.10.211, lessThanOrEqual: 5.10.*, status: unaffected, versionType: custom
version: 5.15.150, lessThanOrEqual: 5.15.*, status: unaffected, versionType: custom
version: 6.1.80, lessThanOrEqual: 6.1.*, status: unaffected, versionType: custom
version: 6.6.19, lessThanOrEqual: 6.6.*, status: unaffected, versionType: custom
version: 6.7.7, lessThanOrEqual: 6.7.*, status: unaffected, versionType: custom
version: 6.8, lessThanOrEqual: *, status: unaffected, versionType: original_commit_for_fix
}
