]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
Input: ims-pcu - fix use-after-free and double-free in disconnect
authorDmitry Torokhov <dmitry.torokhov@gmail.com>
Fri, 22 May 2026 17:24:47 +0000 (10:24 -0700)
committerDmitry Torokhov <dmitry.torokhov@gmail.com>
Sun, 7 Jun 2026 04:00:06 +0000 (21:00 -0700)
commit462a999917755a3bf77448dfd64307963cf0a9f0
tree761e019c9e431ef60fc7ab08148ffb42aef78f36
parent441c510a649c8ddce38aa0311334ed8bb546b36c
Input: ims-pcu - fix use-after-free and double-free in disconnect

ims_pcu_disconnect() only intended to perform cleanup when the primary
(control) interface is unbound. However, it currently relies on the
interface class to distinguish between control and data interfaces.
A malicious device could present a data interface with the same class
as the control interface, leading to premature cleanup and potential
use-after-free or double-free.

Switch to verifying that the interface being disconnected is indeed
the control interface.

Fixes: 628329d52474 ("Input: add IMS Passenger Control Unit driver")
Cc: stable@vger.kernel.org
Reported-by: Sashiko bot <sashiko-bot@kernel.org>
Assisted-by: Gemini:gemini-3.1-pro
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
drivers/input/misc/ims-pcu.c