[PATCH usb v4] usb: gadget: f_fs: fix NULL dereference in ffs_dmabuf_detach()

[PATCH usb v4] usb: gadget: f_fs: fix NULL dereference in ffs_dmabuf_detach()

[Giorgi Kobakhia]

ffs_dmabuf_detach() dereferences ffs->gadget->dev.parent without
checking whether the FunctionFS instance is still bound to UDC.

This can be triggered by mounting FunctionFS, binding it to UDC
instance. Then unbind would make ffs->gadget = NULL. Calling
ffs_epfile_ioctl with code FUNCTIONFS_DMABUF_DETACH ends up in
ffs_dmabuf_detach, dereferencing ffs->gadget.

Crash Log:
Oops: general protection fault
KASAN: null-ptr-deref in range [0x00000000000000b0-0x00000000000000b7]
RIP: 0010:ffs_epfile_ioctl+0x3f1/0x25d0

Fix this by checking ffs->gadget under ffs->mutex, taking a reference
to the parent device before dropping the lock, and returning -ENODEV
if the gadget has already been removed.

Fixes: 7b07a2a7ca02 ("usb: gadget: functionfs: Add DMABUF import interface")
Signed-off-by: Giorgi Kobakhia <mrkobush@gmail.com>
---
 drivers/usb/gadget/function/f_fs.c | 21 ++++++++++++++++++---
 1 file changed, 18 insertions(+), 3 deletions(-)

diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c
index 002c3441bea3..67c8e65a5aa6 100644
--- a/drivers/usb/gadget/function/f_fs.c
+++ b/drivers/usb/gadget/function/f_fs.c
@@ -1553,14 +1553,27 @@ static int ffs_dmabuf_detach(struct file *file, int fd)
 {
 	struct ffs_epfile *epfile = file->private_data;
 	struct ffs_data *ffs = epfile->ffs;
-	struct device *dev = ffs->gadget->dev.parent;
+	struct device *dev;
 	struct ffs_dmabuf_priv *priv, *tmp;
 	struct dma_buf *dmabuf;
 	int ret = -EPERM;
 
+	mutex_lock(&ffs->mutex);
+	if (!ffs->gadget) {
+		mutex_unlock(&ffs->mutex);
+		return -ENODEV;
+	}
+	dev = get_device(ffs->gadget->dev.parent);
+	mutex_unlock(&ffs->mutex);
+
+	if (!dev)
+		return -ENODEV;
+
 	dmabuf = dma_buf_get(fd);
-	if (IS_ERR(dmabuf))
-		return PTR_ERR(dmabuf);
+	if (IS_ERR(dmabuf)) {
+		ret = PTR_ERR(dmabuf);
+		goto out_put_dev;
+	}
 
 	mutex_lock(&epfile->dmabufs_mutex);
 
@@ -1585,6 +1598,8 @@ static int ffs_dmabuf_detach(struct file *file, int fd)
 	mutex_unlock(&epfile->dmabufs_mutex);
 	dma_buf_put(dmabuf);
 
+out_put_dev:
+	put_device(dev);
 	return ret;
 }
 
-- 
2.43.0