[PATCH] usb: gadget: uvc: fix use-after-free in extension drop

[PATCH] usb: gadget: uvc: fix use-after-free in extension drop

[Shuangpeng Bai]

uvcg_extension_make() adds a newly allocated extension unit to the
extension_units list before configfs attaches the item. If attaching the
item fails, configfs unlinks it and invokes the drop callback during error
cleanup.

On this path, config_item_put() in uvcg_extension_drop() can drop the
last reference and free the extension unit. The subsequent list_del() and
descriptor cleanup then access the freed object.

Remove the extension unit from the list and free its descriptors while the
config item still holds the object alive. Drop the config item reference
only after all accesses to the extension unit are complete.

Fixes: 0525210c9840 ("usb: gadget: uvc: Allow definition of XUs in configfs")
Cc: stable@vger.kernel.org
Signed-off-by: Shuangpeng Bai <shuangpeng.kernel@gmail.com>
---
 drivers/usb/gadget/function/uvc_configfs.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/usb/gadget/function/uvc_configfs.c b/drivers/usb/gadget/function/uvc_configfs.c
index 70a1415ea401..86facba5109f 100644
--- a/drivers/usb/gadget/function/uvc_configfs.c
+++ b/drivers/usb/gadget/function/uvc_configfs.c
@@ -1256,12 +1256,13 @@ static void uvcg_extension_drop(struct config_group *group, struct config_item *
 
 	mutex_lock(&opts->lock);
 
-	config_item_put(item);
 	list_del(&xu->list);
 	kfree(xu->desc.baSourceID);
 	kfree(xu->desc.bmControls);
 
 	mutex_unlock(&opts->lock);
+
+	config_item_put(item);
 }
 
 static struct config_item *uvcg_extension_make(struct config_group *group, const char *name)
-- 
2.43.0