In the Linux kernel, the following vulnerability has been resolved:
usb: usbip: fix a refcount leak in stub_probe()
usbgetdev() is called in stubdevicealloc(). When stubprobe() fails after that, usbput_dev() needs to be called to release the reference.
Fix this by moving usbputdev() to sdev_free error path handling.
Find this by code review.
[
{
"signature_type": "Line",
"signature_version": "v1",
"id": "CVE-2022-49389-4f9e86c3",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2f0ae93ec33c8456cdfbf7876b80403a6318ebce",
"digest": {
"line_hashes": [
"169602301072493225392631492625043893323",
"87278530410663368061962561687056580640",
"205363438712346673184459102926553083202",
"324503868310660336186298831158825415287",
"9331991689213032564909124614493191840",
"323221380149215081741094709122647791979",
"84287992761788844456373091956178586118",
"294850170379408004195904228864840966912"
],
"threshold": 0.9
},
"target": {
"file": "drivers/usb/usbip/stub_dev.c"
}
},
{
"signature_type": "Function",
"signature_version": "v1",
"id": "CVE-2022-49389-8d8c6b2a",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2f0ae93ec33c8456cdfbf7876b80403a6318ebce",
"digest": {
"length": 1676.0,
"function_hash": "43847876506402071367236847168217937794"
},
"target": {
"file": "drivers/usb/usbip/stub_dev.c",
"function": "stub_probe"
}
}
]