漏洞标题
usb: dwc3: gadget: 只有释放端点后，才能释放自由的 gadget 结构。
漏洞描述信息
在Linux内核中，已经修复了以下漏洞：
```
usb: dwc3: gadget: 当设备移除时，在dwc->gadget->ep_list上释放gadget结构体后才释放端点
```
在commit e81a7018d93a中的“usb: dwc3: allocate gadget structure dynamically”部分，添加了`dwc3_ gadget_release()`函数，当设备移除时，会释放`dwc->gadget`结构体。然而，在直接释放gadget后，会出现悬挂指针的情况。
随后的`dwc3_ gadget_free_endpoints()`函数在gadget最终被释放之前调用，这可能导致在`list_del()`调用后出现“使用后释放”错误。
这个漏洞是通过启用KASAN（一种内存安全工具）并进行驱动解绑来发现的。最近的一次提交568262bf5492也暴露了这个问题，即在系统关闭时会发生恐慌。修复此漏洞的方法可能包括在适当的时间点释放相关的链表元素。
CVSS信息
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
漏洞类别
释放后使用
漏洞标题
usb: dwc3: gadget: Free gadget structure only after freeing endpoints
漏洞描述信息
In the Linux kernel, the following vulnerability has been resolved:
usb: dwc3: gadget: Free gadget structure only after freeing endpoints
As part of commit e81a7018d93a ("usb: dwc3: allocate gadget structure
dynamically") the dwc3_gadget_release() was added which will free
the dwc->gadget structure upon the device's removal when
usb_del_gadget_udc() is called in dwc3_gadget_exit().
However, simply freeing the gadget results a dangling pointer
situation: the endpoints created in dwc3_gadget_init_endpoints()
have their dep->endpoint.ep_list members chained off the list_head
anchored at dwc->gadget->ep_list. Thus when dwc->gadget is freed,
the first dwc3_ep in the list now has a dangling prev pointer and
likewise for the next pointer of the dwc3_ep at the tail of the list.
The dwc3_gadget_free_endpoints() that follows will result in a
use-after-free when it calls list_del().
This was caught by enabling KASAN and performing a driver unbind.
The recent commit 568262bf5492 ("usb: dwc3: core: Add shutdown
callback for dwc3") also exposes this as a panic during shutdown.
There are a few possibilities to fix this. One could be to perform
a list_del() of the gadget->ep_list itself which removes it from
the rest of the dwc3_ep chain.
Another approach is what this patch does, by splitting up the
usb_del_gadget_udc() call into its separate "del" and "put"
components. This allows dwc3_gadget_free_endpoints() to be
called before the gadget is finally freed with usb_put_gadget().
CVSS信息
N/A
漏洞类别
N/A
漏洞标题
Linux kernel 安全漏洞
漏洞描述信息
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel 存在安全漏洞。目前尚无此漏洞的相关信息，请随时关注CNNVD或厂商公告。
CVSS信息
N/A
漏洞类别
其他