kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-22 19:14:51 +00:00
Code Issues Releases Packages Activity
linux/drivers/usb/gadget
History
Eddie Hung a4b202cba3 usb: gadget: configfs: Fix use-after-free issue with udc_name 
commit 64e6bbfff5 upstream.

There is a use-after-free issue, if access udc_name
in function gadget_dev_desc_UDC_store after another context
free udc_name in function unregister_gadget.

Context 1:
gadget_dev_desc_UDC_store()->unregister_gadget()->
free udc_name->set udc_name to NULL

Context 2:
gadget_dev_desc_UDC_show()-> access udc_name

Call trace:
dump_backtrace+0x0/0x340
show_stack+0x14/0x1c
dump_stack+0xe4/0x134
print_address_description+0x78/0x478
__kasan_report+0x270/0x2ec
kasan_report+0x10/0x18
__asan_report_load1_noabort+0x18/0x20
string+0xf4/0x138
vsnprintf+0x428/0x14d0
sprintf+0xe4/0x12c
gadget_dev_desc_UDC_show+0x54/0x64
configfs_read_file+0x210/0x3a0
__vfs_read+0xf0/0x49c
vfs_read+0x130/0x2b4
SyS_read+0x114/0x208
el0_svc_naked+0x34/0x38

Add mutex_lock to protect this kind of scenario.

Signed-off-by: Eddie Hung <eddie.hung@mediatek.com>
Signed-off-by: Macpaul Lin <macpaul.lin@mediatek.com>
Reviewed-by: Peter Chen <peter.chen@nxp.com>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/1609239215-21819-1-git-send-email-macpaul.lin@mediatek.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
History 2021-01-12 20:18:21 +01:00
..
function usb: gadget: u_ether: Fix MTU size mismatch with RX packet size 2021-01-12 20:18:21 +01:00
legacy USB: gadget: legacy: fix return error code in acm_ms_bind() 2021-01-12 20:18:21 +01:00
udc USB: Gadget: dummy-hcd: Fix shift-out-of-bounds bug 2021-01-12 20:18:20 +01:00
composite.c usb: gadget: Fix spinlock lockup on usb_function_deactivate 2021-01-12 20:18:21 +01:00
config.c USB: gadget: Remove redundant license text 2017-11-07 15:45:02 +01:00
configfs.c usb: gadget: configfs: Fix use-after-free issue with udc_name 2021-01-12 20:18:21 +01:00
configfs.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
epautoconf.c usb: gadget: move non-super speed code out of usb_ep_autoconfig_ss() 2019-02-07 13:14:51 +02:00
functions.c USB: add SPDX identifiers to all remaining files in drivers/usb/ 2017-11-04 11:48:02 +01:00
Kconfig usb: gadget: select CONFIG_CRC32 2021-01-12 20:18:20 +01:00
Makefile Revert "usb:gadget Separated decoding functions from dwc3 driver." 2019-07-04 13:02:09 +02:00
u_f.c usb: gadget: Change Andrzej Pietrasiewicz's e-mail address 2019-02-11 11:12:29 +02:00
u_f.h USB: gadget: u_f: Unbreak offset calculation in VLAs 2020-08-27 09:25:06 +02:00
u_os_desc.h usb: gadget: Change Andrzej Pietrasiewicz's e-mail address 2019-02-11 11:12:29 +02:00
usbstring.c usb: gadget: fix langid kernel-doc warning in usbstring.c 2020-07-09 10:13:07 +03:00