From: Robert Baldyga <r.baldyga@hackerion.com>
To: changbin.du@intel.com, balbi@ti.com, gregkh@linuxfoundation.org
Cc: r.baldyga@samsung.com, nab@linux-iscsi.org,
andrzej.p@samsung.com, linux-usb@vger.kernel.org,
linux-kernel@vger.kernel.org
Subject: Re: [PATCH] usb: gadget: acm: set notify_req to NULL after freed to avoid double free
Date: Sun, 27 Dec 2015 23:05:15 +0100 [thread overview]
Message-ID: <5680609B.3070209@hackerion.com> (raw)
In-Reply-To: <1451102260-13204-1-git-send-email-changbin.du@intel.com>
On 12/26/2015 04:57 AM, changbin.du@intel.com wrote:
> From: "Du, Changbin" <changbin.du@intel.com>
>
> If acm_bind fails before allocate notification and acm->notify_req is
> not set to NULL after freed last time, double free will happen.
Looks good to me.
Similar problem can occur with another USB functions (at least f_ecm,
f_ncm, f_rndis and f_hid handle USB requests in analogical way). Maybe
it's worth to fix them all at once?
>
> kernel BUG at mm/slub.c:3392!
> invalid opcode: 0000 [#1] PREEMPT SMP
> EIP is at kfree+0x172/0x180
> Call Trace:
> [<80c0e3b6>] ? usb_ep_autoconfig_ss+0x86/0x170
> [<80c13345>] gs_free_req+0x15/0x30
> [<80c12df1>] acm_bind+0x1c1/0x2d0
> [<80c0e9be>] usb_add_function+0x6e/0x120
> [<80c213cb>] acm_function_bind_config+0x2b/0x90
>
Reviewed-by: Robert Baldyga <r.baldyga@hackerion.com>
> Signed-off-by: Du, Changbin <changbin.du@intel.com>
> ---
> drivers/usb/gadget/function/f_acm.c | 8 ++++++--
> 1 file changed, 6 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/usb/gadget/function/f_acm.c b/drivers/usb/gadget/function/f_acm.c
> index 2fa1e80..e10c8d4 100644
> --- a/drivers/usb/gadget/function/f_acm.c
> +++ b/drivers/usb/gadget/function/f_acm.c
> @@ -699,8 +699,10 @@ acm_bind(struct usb_configuration *c, struct usb_function *f)
> return 0;
>
> fail:
> - if (acm->notify_req)
> + if (acm->notify_req) {
> gs_free_req(acm->notify, acm->notify_req);
> + acm->notify_req = NULL;
> + }
>
> ERROR(cdev, "%s/%p: can't bind, err %d\n", f->name, f, status);
>
> @@ -713,8 +715,10 @@ static void acm_unbind(struct usb_configuration *c, struct usb_function *f)
>
> acm_string_defs[0].id = 0;
> usb_free_all_descriptors(f);
> - if (acm->notify_req)
> + if (acm->notify_req) {
> gs_free_req(acm->notify, acm->notify_req);
> + acm->notify_req = NULL;
> + }
> }
>
> static void acm_free_func(struct usb_function *f)
>
next prev parent reply other threads:[~2015-12-27 22:21 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2015-12-26 3:57 [PATCH] usb: gadget: acm: set notify_req to NULL after freed to avoid double free changbin.du
2015-12-27 22:05 ` Robert Baldyga [this message]
2015-12-28 6:06 ` Du, Changbin
2015-12-28 6:25 ` [PATCH v2] usb: gadget: fix double mem free for usb_request caused by wild pointers changbin.du
2015-12-28 21:13 ` Laurent Pinchart
2015-12-28 22:04 ` Robert Baldyga
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=5680609B.3070209@hackerion.com \
--to=r.baldyga@hackerion.com \
--cc=andrzej.p@samsung.com \
--cc=balbi@ti.com \
--cc=changbin.du@intel.com \
--cc=gregkh@linuxfoundation.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-usb@vger.kernel.org \
--cc=nab@linux-iscsi.org \
--cc=r.baldyga@samsung.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.