usb: gadget: composite: Fix double free memory bug

[Manu Gautam <mgautam@codeaurora.org>]

Hi,

On 2019-03-15 16:37, Chandana Kishori Chiluveru wrote:
> configfs_dev_cleanup function can double free os_desc
> and buffer when called from different context. For
> example, this can be called from composite_unbind() and
> when composite_bind() fails.

Shouldn't we instead fix the error path handling of composite_bind
and configfs_composite_bind?

> Fix this issue by setting
> request and buffer pointer to NULL after kfree.
> 
> Signed-off-by: Chandana Kishori Chiluveru <cchiluve@codeaurora.org>
> ---
>  drivers/usb/gadget/composite.c | 4 ++++
>  1 file changed, 4 insertions(+)
> 
> diff --git a/drivers/usb/gadget/composite.c 
> b/drivers/usb/gadget/composite.c
> index b8a1584..992f1e2 100644
> --- a/drivers/usb/gadget/composite.c
> +++ b/drivers/usb/gadget/composite.c
> @@ -2155,14 +2155,18 @@ void composite_dev_cleanup(struct
> usb_composite_dev *cdev)
>  			usb_ep_dequeue(cdev->gadget->ep0, cdev->os_desc_req);
> 
>  		kfree(cdev->os_desc_req->buf);
> +		cdev->os_desc_req->buf = NULL;
>  		usb_ep_free_request(cdev->gadget->ep0, cdev->os_desc_req);
> +		cdev->os_desc_req = NULL;

Better to move os_desc_cleanup handling to a different function
say - composite_os_desc_req_cleanup (to match 
composite_os_desc_req_prepare())

>  	}
>  	if (cdev->req) {
>  		if (cdev->setup_pending)
>  			usb_ep_dequeue(cdev->gadget->ep0, cdev->req);
> 
>  		kfree(cdev->req->buf);
> +		cdev->req->buf = NULL;
>  		usb_ep_free_request(cdev->gadget->ep0, cdev->req);
> +		cdev->req = NULL;
>  	}
>  	cdev->next_string_id = 0;
>  	device_remove_file(&cdev->gadget->dev, &dev_attr_suspended);