Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Skip to content
Commit 2df1806a authored by Pratham Pratap's avatar Pratham Pratap Committed by Gerrit - the friendly Code Review server
Browse files

usb: f_fs: Avoid use-after-free of ffs_data



Consider a case, where ffs_func_unbind was called twice due to some
reason and the opts->refcnt becomes NULL causing functionfs_unbind
to happen. This will free the ffs_data structure but later in the
function it is being used to add ffs_event which can lead to UAF
scenario. Avoid this by returning early from ffs_func_unbind function.
While we are at it, let's say ffs_epfile_io (which will be called from
ffs_epfile_read_iter) is called after functionfs_unbind happened then
there is a possibility the driver may end up using already freed
ffs_data. Fix it by initializing the variable after the FFS_ACTIVE
check.

Change-Id: Ic04857f95a6756d2d177bfbc382a11ffd651ef62
Signed-off-by: default avatarPratham Pratap <prathampratap@codeaurora.org>
parent 120c562b
Loading
Loading
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please register or to comment