usb: f_fs: Avoid use-after-free of ffs_data
Consider a case, where ffs_func_unbind was called twice due to some
reason and the opts->refcnt becomes NULL causing functionfs_unbind
to happen. This will free the ffs_data structure but later in the
function it is being used to add ffs_event which can lead to UAF
scenario. Avoid this by returning early from ffs_func_unbind function.
While we are at it, let's say ffs_epfile_io (which will be called from
ffs_epfile_read_iter) is called after functionfs_unbind happened then
there is a possibility the driver may end up using already freed
ffs_data. Fix it by initializing the variable after the FFS_ACTIVE
check.
Change-Id: Ic04857f95a6756d2d177bfbc382a11ffd651ef62
Signed-off-by:
Pratham Pratap <prathampratap@codeaurora.org>
Loading
Please register or sign in to comment