]>
Commit | Line | Data |
---|---|---|
a8f08d76 GKH |
1 | From cdafb6d8b8da7fde266f79b3287ac221aa841879 Mon Sep 17 00:00:00 2001 |
2 | From: Andrew Gabbasov <andrew_gabbasov@mentor.com> | |
3 | Date: Wed, 8 Nov 2017 10:13:15 -0700 | |
4 | Subject: usb: gadget: f_fs: Fix use-after-free in ffs_free_inst | |
5 | ||
6 | From: Andrew Gabbasov <andrew_gabbasov@mentor.com> | |
7 | ||
8 | commit cdafb6d8b8da7fde266f79b3287ac221aa841879 upstream. | |
9 | ||
10 | KASAN enabled configuration reports an error | |
11 | ||
12 | BUG: KASAN: use-after-free in ffs_free_inst+... [usb_f_fs] at addr ... | |
13 | Write of size 8 by task ... | |
14 | ||
15 | This is observed after "ffs-test" is run and interrupted. If after that | |
16 | functionfs is unmounted and g_ffs module is unloaded, that use-after-free | |
17 | occurs during g_ffs module removal. | |
18 | ||
19 | Although the report indicates ffs_free_inst() function, the actual | |
20 | use-after-free condition occurs in _ffs_free_dev() function, which | |
21 | is probably inlined into ffs_free_inst(). | |
22 | ||
23 | This happens due to keeping the ffs_data reference in device structure | |
24 | during functionfs unmounting, while ffs_data itself is freed as no longer | |
25 | needed. The fix is to clear that reference in ffs_closed() function, | |
26 | which is a counterpart of ffs_ready(), where the reference is stored. | |
27 | ||
28 | Fixes: 3262ad824307 ("usb: gadget: f_fs: Stop ffs_closed NULL pointer dereference") | |
29 | Signed-off-by: Andrew Gabbasov <andrew_gabbasov@mentor.com> | |
30 | Acked-by: Felipe Balbi <felipe.balbi@linux.intel.com> | |
31 | Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> | |
32 | Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> | |
33 | ||
34 | --- | |
35 | drivers/usb/gadget/function/f_fs.c | 1 + | |
36 | 1 file changed, 1 insertion(+) | |
37 | ||
38 | --- a/drivers/usb/gadget/function/f_fs.c | |
39 | +++ b/drivers/usb/gadget/function/f_fs.c | |
40 | @@ -3669,6 +3669,7 @@ static void ffs_closed(struct ffs_data * | |
41 | goto done; | |
42 | ||
43 | ffs_obj->desc_ready = false; | |
44 | + ffs_obj->ffs_data = NULL; | |
45 | ||
46 | if (test_and_clear_bit(FFS_FL_CALL_CLOSED_CALLBACK, &ffs->flags) && | |
47 | ffs_obj->ffs_closed_callback) |