kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-20 19:23:40 +00:00
Code Issues Releases Packages Activity
linux/drivers/usb/gadget
History
Andrew Gabbasov fd6a742d8b usb: gadget: f_fs: Fix use-after-free in ffs_free_inst 
commit cdafb6d8b8 upstream.

KASAN enabled configuration reports an error

BUG: KASAN: use-after-free in ffs_free_inst+... [usb_f_fs] at addr ...
Write of size 8 by task ...

This is observed after "ffs-test" is run and interrupted. If after that
functionfs is unmounted and g_ffs module is unloaded, that use-after-free
occurs during g_ffs module removal.

Although the report indicates ffs_free_inst() function, the actual
use-after-free condition occurs in _ffs_free_dev() function, which
is probably inlined into ffs_free_inst().

This happens due to keeping the ffs_data reference in device structure
during functionfs unmounting, while ffs_data itself is freed as no longer
needed. The fix is to clear that reference in ffs_closed() function,
which is a counterpart of ffs_ready(), where the reference is stored.

Fixes: 3262ad8243 ("usb: gadget: f_fs: Stop ffs_closed NULL pointer dereference")
Signed-off-by: Andrew Gabbasov <andrew_gabbasov@mentor.com>
Acked-by: Felipe Balbi <felipe.balbi@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
History 2017-11-21 09:23:29 +01:00
..
function usb: gadget: f_fs: Fix use-after-free in ffs_free_inst 2017-11-21 09:23:29 +01:00
legacy USB: g_mass_storage: Fix deadlock when driver is unbound 2017-10-12 11:51:17 +02:00
udc USB: dummy-hcd: Fix deadlock caused by disconnect detection 2017-10-18 09:35:38 +02:00
composite.c usb: gadget: composite: Fix use-after-free in usb_composite_overwrite_options 2017-10-18 09:35:40 +02:00
config.c usb: Use (foo *) instead of (foo*). 2016-06-21 11:16:15 +03:00
configfs.c usb: gadget: configfs: Fix memory leak of interface directory data 2017-10-18 09:35:40 +02:00
configfs.h usb: gadget: configfs: Fix memory leak of interface directory data 2017-10-18 09:35:40 +02:00
epautoconf.c usb: gadget: epautoconf: add usb_ep_autoconfig_release() function 2015-09-27 10:54:31 -05:00
functions.c usb: gadget: add a forward pointer from usb_function to its "instance" 2013-01-21 20:52:46 +02:00
Kconfig usb: gadget: legacy gadgets are optional 2017-05-20 14:28:35 +02:00
Makefile usb: gadget: use $(srctree) instead of $(PWD) for includes 2014-08-29 15:53:46 -05:00
u_f.c usb: gadget: remove useless parameter in alloc_ep_req() 2016-08-25 12:13:19 +03:00
u_f.h usb: gadget: remove useless parameter in alloc_ep_req() 2016-08-25 12:13:19 +03:00
u_os_desc.h usb: gadget: u_os_desc: helper functions for accessing ext prop buffer 2014-07-10 08:36:51 -05:00
usbstring.c usb: delete non-required instances of include <linux/init.h> 2014-01-08 15:01:39 -08:00