summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorAndrew Gabbasov <andrew_gabbasov@mentor.com>2017-11-08 10:13:15 -0700
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>2017-11-21 09:23:29 +0100
commitfd6a742d8bf7eac61d6351cb5d77f97a71f099bd (patch)
tree531a29df064c2a6c542d85265c647c04c4cd67e8
parent599973738e282af0f3f78682ce4ef4908dda6a2c (diff)
downloadlinux-stable-fd6a742d8bf7eac61d6351cb5d77f97a71f099bd.tar.gz
linux-stable-fd6a742d8bf7eac61d6351cb5d77f97a71f099bd.tar.bz2
linux-stable-fd6a742d8bf7eac61d6351cb5d77f97a71f099bd.zip
usb: gadget: f_fs: Fix use-after-free in ffs_free_inst
commit cdafb6d8b8da7fde266f79b3287ac221aa841879 upstream. KASAN enabled configuration reports an error BUG: KASAN: use-after-free in ffs_free_inst+... [usb_f_fs] at addr ... Write of size 8 by task ... This is observed after "ffs-test" is run and interrupted. If after that functionfs is unmounted and g_ffs module is unloaded, that use-after-free occurs during g_ffs module removal. Although the report indicates ffs_free_inst() function, the actual use-after-free condition occurs in _ffs_free_dev() function, which is probably inlined into ffs_free_inst(). This happens due to keeping the ffs_data reference in device structure during functionfs unmounting, while ffs_data itself is freed as no longer needed. The fix is to clear that reference in ffs_closed() function, which is a counterpart of ffs_ready(), where the reference is stored. Fixes: 3262ad824307 ("usb: gadget: f_fs: Stop ffs_closed NULL pointer dereference") Signed-off-by: Andrew Gabbasov <andrew_gabbasov@mentor.com> Acked-by: Felipe Balbi <felipe.balbi@linux.intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-rw-r--r--drivers/usb/gadget/function/f_fs.c1
1 files changed, 1 insertions, 0 deletions
diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c
index f9c99803a43d..273320fa30ae 100644
--- a/drivers/usb/gadget/function/f_fs.c
+++ b/drivers/usb/gadget/function/f_fs.c
@@ -3698,6 +3698,7 @@ static void ffs_closed(struct ffs_data *ffs)
goto done;
ffs_obj->desc_ready = false;
+ ffs_obj->ffs_data = NULL;
if (test_and_clear_bit(FFS_FL_CALL_CLOSED_CALLBACK, &ffs->flags) &&
ffs_obj->ffs_closed_callback)