| From cdafb6d8b8da7fde266f79b3287ac221aa841879 Mon Sep 17 00:00:00 2001 |
| From: Andrew Gabbasov <andrew_gabbasov@mentor.com> |
| Date: Wed, 8 Nov 2017 10:13:15 -0700 |
| Subject: usb: gadget: f_fs: Fix use-after-free in ffs_free_inst |
| |
| From: Andrew Gabbasov <andrew_gabbasov@mentor.com> |
| |
| commit cdafb6d8b8da7fde266f79b3287ac221aa841879 upstream. |
| |
| KASAN enabled configuration reports an error |
| |
| BUG: KASAN: use-after-free in ffs_free_inst+... [usb_f_fs] at addr ... |
| Write of size 8 by task ... |
| |
| This is observed after "ffs-test" is run and interrupted. If after that |
| functionfs is unmounted and g_ffs module is unloaded, that use-after-free |
| occurs during g_ffs module removal. |
| |
| Although the report indicates ffs_free_inst() function, the actual |
| use-after-free condition occurs in _ffs_free_dev() function, which |
| is probably inlined into ffs_free_inst(). |
| |
| This happens due to keeping the ffs_data reference in device structure |
| during functionfs unmounting, while ffs_data itself is freed as no longer |
| needed. The fix is to clear that reference in ffs_closed() function, |
| which is a counterpart of ffs_ready(), where the reference is stored. |
| |
| Fixes: 3262ad824307 ("usb: gadget: f_fs: Stop ffs_closed NULL pointer dereference") |
| Signed-off-by: Andrew Gabbasov <andrew_gabbasov@mentor.com> |
| Acked-by: Felipe Balbi <felipe.balbi@linux.intel.com> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| |
| --- |
| drivers/usb/gadget/function/f_fs.c | 1 + |
| 1 file changed, 1 insertion(+) |
| |
| --- a/drivers/usb/gadget/function/f_fs.c |
| +++ b/drivers/usb/gadget/function/f_fs.c |
| @@ -3677,6 +3677,7 @@ static void ffs_closed(struct ffs_data * |
| goto done; |
| |
| ffs_obj->desc_ready = false; |
| + ffs_obj->ffs_data = NULL; |
| |
| if (test_and_clear_bit(FFS_FL_CALL_CLOSED_CALLBACK, &ffs->flags) && |
| ffs_obj->ffs_closed_callback) |
