瀏覽代碼

Kernel/USB: Remove UAF in device removal

I was using a raw pointer instead of a RefPtr to keep the device alive
during removal.
Luke 4 年之前
父節點
當前提交
51b6bd8d95
共有 1 個文件被更改,包括 2 次插入2 次删除
  1. 2 2
      Kernel/Bus/USB/USBHub.cpp

+ 2 - 2
Kernel/Bus/USB/USBHub.cpp

@@ -297,7 +297,7 @@ void Hub::check_for_port_updates()
             } else {
             } else {
                 dbgln("USB Hub: Device detached on port {}!", port_number);
                 dbgln("USB Hub: Device detached on port {}!", port_number);
 
 
-                Device* device_to_remove = nullptr;
+                RefPtr<Device> device_to_remove = nullptr;
                 for (auto& child : m_children) {
                 for (auto& child : m_children) {
                     if (port_number == child.port()) {
                     if (port_number == child.port()) {
                         device_to_remove = &child;
                         device_to_remove = &child;
@@ -310,7 +310,7 @@ void Hub::check_for_port_updates()
                     SysFSUSBBusDirectory::the().unplug(*device_to_remove);
                     SysFSUSBBusDirectory::the().unplug(*device_to_remove);
 
 
                     if (device_to_remove->device_descriptor().device_class == USB_CLASS_HUB) {
                     if (device_to_remove->device_descriptor().device_class == USB_CLASS_HUB) {
-                        auto* hub_child = static_cast<Hub*>(device_to_remove);
+                        auto* hub_child = static_cast<Hub*>(device_to_remove.ptr());
                         hub_child->remove_children_from_sysfs();
                         hub_child->remove_children_from_sysfs();
                     }
                     }
                 } else {
                 } else {