Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Skip to content
Commit 4925b858 authored by Udipto Goswami's avatar Udipto Goswami Committed by Gerrit - the friendly Code Review server
Browse files

usb: f_fs: Fix Double free from ffs_data_clear



Suppose if the userspace using ffs failed to open
ep0, it will issue a ep0_release and continuously try to do
ep0_open until it gets through.
The general operation of ep0_release is the it will destroy
the epfile and free the structures. Whole thing follows this
path:

ffs_ep0_release
	ffs_data_reset
		ffs_data_clear
		kfree(epfiles) mark NULL
		kfree(raw_desc)
	raw_desc =NULL

Now the last few steps of the release process is done without
any mutex. In one functions we do kfree and another we mark
NULL.
This created a potential double free scenario, if a ep0_release
process got preempted before kfree, meanwhile another ep0_release
gets through and freed up the structures but didn't mark NULL
and within that time the preempted process wakes up and tried
to kfree again, due to structure not marked NULL will lead to
double free/invalid free.

Following is the illustration:

     CPU2                                   CPU3

ffs_ep0_release
ffs_data_reset
ffs_data_clear
  kfree(epfiles)
  epfiles = NULL

--preempted--
					ffs_ep0_release
					ffs_data_reset
					ffs_data_clear
					 kfree(epfiles)
					 epfiles = NULL
					 kfree(ffs->raw_descs_data)
					 kfree(ffs->raw_strings)
					 kfree(ffs->stringtabs)
--woke-up--
  kfree(ffs->raw_descs_data)
<use-after-free>
raw_desc =NULL

Fix this by performing kfree and NULL operations under
ffs_data_clear within a mutex lock.

Change-Id: I1c8d92ff99c30165b06bafdd00bc9eb610f3bb76
Signed-off-by: default avatarUdipto Goswami <quic_ugoswami@quicinc.com>
parent a0072c96
Loading
Loading
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please register or to comment