Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit e877b729 authored by Heinrich Schuchardt's avatar Heinrich Schuchardt Committed by Felipe Balbi
Browse files

usb: gadget: f_tcm: out of bound access in usbg_drop_tpg 



Commit dc8c46a5 ("usb: gadget: f_tcm: convert to new function
interface with backward compatibility") introduced a possible out
of bounds memory access:

If tpg is not found in function usbg_drop_tpg,
tpg_instances[TPG_INSTANCES] is accessed.

Fixes: dc8c46a5 ("usb: gadget: f_tcm: convert to new function interface with backward compatibility")
Signed-off-by: default avatarHeinrich Schuchardt <xypron.glpk@gmx.de>
Signed-off-by: default avatarFelipe Balbi <felipe.balbi@linux.intel.com>
parent ffeee83a

drivers/usb/gadget/function/f_tcm.c

+11 −9
Original line number Diff line number Diff line
@@ -1445,7 +1445,7 @@ static void usbg_drop_tpg(struct se_portal_group *se_tpg) 
	for (i = 0; i < TPG_INSTANCES; ++i)

		if (tpg_instances[i].tpg == tpg)

			break;

	if (i < TPG_INSTANCES)

	if (i < TPG_INSTANCES) {

		tpg_instances[i].tpg = NULL;

		opts = container_of(tpg_instances[i].func_inst,

			struct f_tcm_opts, func_inst);
@@ -1453,8 +1453,10 @@ static void usbg_drop_tpg(struct se_portal_group *se_tpg) 
		if (opts->has_dep)

			module_put(opts->dependent);

		else

		configfs_undepend_item_unlocked(&opts->func_inst.group.cg_item);

			configfs_undepend_item_unlocked(

				&opts->func_inst.group.cg_item);

		mutex_unlock(&opts->dep_lock);

	}

	mutex_unlock(&tpg_instances_lock);



	kfree(tpg);