kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-11-13 07:31:07 +00:00
Code Issues Releases Packages Activity
linux/drivers/usb/gadget
History
Andrew Gabbasov d74d586746 usb: gadget: f_fs: Fix use-after-free in ffs_free_inst 
commit cdafb6d8b8 upstream.

KASAN enabled configuration reports an error

BUG: KASAN: use-after-free in ffs_free_inst+... [usb_f_fs] at addr ...
Write of size 8 by task ...

This is observed after "ffs-test" is run and interrupted. If after that
functionfs is unmounted and g_ffs module is unloaded, that use-after-free
occurs during g_ffs module removal.

Although the report indicates ffs_free_inst() function, the actual
use-after-free condition occurs in _ffs_free_dev() function, which
is probably inlined into ffs_free_inst().

This happens due to keeping the ffs_data reference in device structure
during functionfs unmounting, while ffs_data itself is freed as no longer
needed. The fix is to clear that reference in ffs_closed() function,
which is a counterpart of ffs_ready(), where the reference is stored.

Fixes: 3262ad8243 ("usb: gadget: f_fs: Stop ffs_closed NULL pointer dereference")
Signed-off-by: Andrew Gabbasov <andrew_gabbasov@mentor.com>
Acked-by: Felipe Balbi <felipe.balbi@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
History 2017-11-21 09:49:22 +01:00
..
function usb: gadget: f_fs: Fix use-after-free in ffs_free_inst 2017-11-21 09:49:22 +01:00
legacy License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
udc License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
composite.c usb: gadget: composite: Fix use-after-free in usb_composite_overwrite_options 2017-10-11 13:14:30 +03:00
config.c usb: Use (foo *) instead of (foo*). 2016-06-21 11:16:15 +03:00
configfs.c usb: gadget: configfs: Fix memory leak of interface directory data 2017-10-11 13:14:37 +03:00
configfs.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
epautoconf.c usb: gadget: epautoconf: add usb_ep_autoconfig_release() function 2015-09-27 10:54:31 -05:00
functions.c usb: gadget: add a forward pointer from usb_function to its "instance" 2013-01-21 20:52:46 +02:00
Kconfig usb: gadget: allow serial gadget console on other configs 2017-08-15 14:18:54 +03:00
Makefile License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
u_f.c usb: gadget: remove useless parameter in alloc_ep_req() 2016-08-25 12:13:19 +03:00
u_f.h usb: gadget: remove useless parameter in alloc_ep_req() 2016-08-25 12:13:19 +03:00
u_os_desc.h usb: gadget: u_os_desc: helper functions for accessing ext prop buffer 2014-07-10 08:36:51 -05:00
usbstring.c usb: delete non-required instances of include <linux/init.h> 2014-01-08 15:01:39 -08:00