Wind River Support Network

Description

In the Linux kernel, the following vulnerability has been resolved:  media: as102: fix to not free memory after the device is registered in as102_usb_probe()  In as102_usb driver, the following race condition occurs: ``` 		CPU0						CPU1 as102_usb_probe()   kzalloc(); // alloc as102_dev_t   ....   usb_register_dev(); 						fd = sys_open("/path/to/dev"); // open as102 fd 						....   usb_deregister_dev();   ....   kfree(); // free as102_dev_t   .... 						sys_close(fd); 						  as102_release() // UAF!! 						    as102_usb_release() 						      kfree(); // DFB!! ```  When a USB character device registered with usb_register_dev() is later unregistered (via usb_deregister_dev() or disconnect), the device node is removed so new open() calls fail. However, file descriptors that are already open do not go away immediately: they remain valid until the last reference is dropped and the driver's .release() is invoked.  In as102, as102_usb_probe() calls usb_register_dev() and then, on an error path, does usb_deregister_dev() and frees as102_dev_t right away. If userspace raced a successful open() before the deregistration, that open FD will later hit as102_release() --> as102_usb_release() and access or free as102_dev_t again, occur a race to use-after-free and double-free vuln.  The fix is to never kfree(as102_dev_t) directly once usb_register_dev() has succeeded. After deregistration, defer freeing memory to .release().  In other words, let release() perform the last kfree when the final open FD is closed.