Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 4958cf32 authored by Alexey Khoroshilov's avatar Alexey Khoroshilov Committed by Felipe Balbi
Browse files

usb: dbgp gadget: fix use after free in dbgp_unbind() 



After dbgp_bind()-dbgp_unbind() cycle happens, static variable dbgp
contains pointers to already deallocated memory (dbgp.serial and dbgp.req).
If the next dbgp_bind() fails, for example in usb_ep_alloc_request(),
dbgp_bind() calls dbgp_unbind() on failure path,
and dbgp_unbind() frees dbgp.serial that still stores a pointer
to already deallocated memory.

The patch sets pointers to NULL in dbgp_unbind().

Found by Linux Driver Verification project (linuxtesting.org).

Signed-off-by: default avatarAlexey Khoroshilov <khoroshilov@ispras.ru>
Signed-off-by: default avatarFelipe Balbi <balbi@ti.com>
parent 0c582408

drivers/usb/gadget/legacy/dbgp.c

+2 −0
Original line number Diff line number Diff line
@@ -222,10 +222,12 @@ static void dbgp_unbind(struct usb_gadget *gadget) 
{

#ifdef CONFIG_USB_G_DBGP_SERIAL

	kfree(dbgp.serial);

	dbgp.serial = NULL;

#endif

	if (dbgp.req) {

		kfree(dbgp.req->buf);

		usb_ep_free_request(gadget->ep0, dbgp.req);

		dbgp.req = NULL;

	}



	gadget->ep0->driver_data = NULL;