]> git.baikalelectronics.ru Git - kernel.git/commit
usb: gadget: composite: Fix use-after-free in usb_composite_overwrite_options
authorAndrew Gabbasov <andrew_gabbasov@mentor.com>
Sat, 30 Sep 2017 15:55:55 +0000 (08:55 -0700)
committerFelipe Balbi <felipe.balbi@linux.intel.com>
Wed, 11 Oct 2017 10:14:30 +0000 (13:14 +0300)
commit0243a877ceab3f982e9ec9c16a8e75ee5e3c7979
tree9925bd20ffe7f0962bcfaf201b4e0872cfa7e523
parent2b0510c297bac5a8615e17fcd945c593bc5c25fc
usb: gadget: composite: Fix use-after-free in usb_composite_overwrite_options

KASAN enabled configuration reports an error

    BUG: KASAN: use-after-free in usb_composite_overwrite_options+...
                [libcomposite] at addr ...
    Read of size 1 by task ...

when some driver is un-bound and then bound again.
For example, this happens with FunctionFS driver when "ffs-test"
test application is run several times in a row.

If the driver has empty manufacturer ID string in initial static data,
it is then replaced with generated string. After driver unbinding
the generated string is freed, but the driver data still keep that
pointer. And if the driver is then bound again, that pointer
is re-used for string emptiness check.

The fix is to clean up the driver string data upon its unbinding
to drop the pointer to freed memory.

Fixes: f84924bd9fa3 ("usb: gadget: Provide a default implementation of default manufacturer string")
Cc: stable@vger.kernel.org
Signed-off-by: Andrew Gabbasov <andrew_gabbasov@mentor.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
drivers/usb/gadget/composite.c