diff options
| author | Jim Baxter <jim_baxter@mentor.com> | 2016-09-08 11:18:16 +0200 |
|---|---|---|
| committer | Felipe Balbi <felipe.balbi@linux.intel.com> | 2016-09-08 13:53:01 +0300 |
| commit | 3262ad824307c275922161e82c2db1458822f28c (patch) | |
| tree | 92e829db6fad476dd9c69301ba5b647fb2f0cd80 /drivers/usb | |
| parent | 9d6173e125d92e38d4e39bc71f0c3c2cf95cba1a (diff) | |
| download | linux-stable-3262ad824307c275922161e82c2db1458822f28c.tar.gz linux-stable-3262ad824307c275922161e82c2db1458822f28c.tar.bz2 linux-stable-3262ad824307c275922161e82c2db1458822f28c.zip | |
usb: gadget: f_fs: Stop ffs_closed NULL pointer dereference
The struct ffs_data::private_data has a pointer to
ffs_dev stored in it during the ffs_fs_mount() function
however it is not cleared when the ffs_dev is freed
later which causes the ffs_closed function to crash
with "Unable to handle kernel NULL pointer dereference"
error when using the data in ffs_data::private_data.
This clears this pointer during the ffs_free_dev clean
up function.
Signed-off-by: Jim Baxter <jim_baxter@mentor.com>
Signed-off-by: Jiada Wang <jiada_wang@mentor.com>
Signed-off-by: Harish Jenny K N <harish_kandiga@mentor.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
Diffstat (limited to 'drivers/usb')
| -rw-r--r-- | drivers/usb/gadget/function/f_fs.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c index 998697bd80ac..0aeed85bb5cb 100644 --- a/drivers/usb/gadget/function/f_fs.c +++ b/drivers/usb/gadget/function/f_fs.c @@ -3502,6 +3502,11 @@ static void _ffs_free_dev(struct ffs_dev *dev) list_del(&dev->entry); if (dev->name_allocated) kfree(dev->name); + + /* Clear the private_data pointer to stop incorrect dev access */ + if (dev->ffs_data) + dev->ffs_data->private_data = NULL; + kfree(dev); if (list_empty(&ffs_devices)) functionfs_cleanup(); |