* usb: gadget: composite: Fix double free memory bug
@ 2019-03-15 11:07 Chandana Kishori Chiluveru
0 siblings, 0 replies; 2+ messages in thread
From: Chandana Kishori Chiluveru @ 2019-03-15 11:07 UTC (permalink / raw)
To: linux-usb; +Cc: Chandana Kishori Chiluveru
configfs_dev_cleanup function can double free os_desc
and buffer when called from different context. For
example, this can be called from composite_unbind() and
when composite_bind() fails. Fix this issue by setting
request and buffer pointer to NULL after kfree.
Signed-off-by: Chandana Kishori Chiluveru <cchiluve@codeaurora.org>
---
drivers/usb/gadget/composite.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/usb/gadget/composite.c b/drivers/usb/gadget/composite.c
index b8a1584..992f1e2 100644
--- a/drivers/usb/gadget/composite.c
+++ b/drivers/usb/gadget/composite.c
@@ -2155,14 +2155,18 @@ void composite_dev_cleanup(struct usb_composite_dev *cdev)
usb_ep_dequeue(cdev->gadget->ep0, cdev->os_desc_req);
kfree(cdev->os_desc_req->buf);
+ cdev->os_desc_req->buf = NULL;
usb_ep_free_request(cdev->gadget->ep0, cdev->os_desc_req);
+ cdev->os_desc_req = NULL;
}
if (cdev->req) {
if (cdev->setup_pending)
usb_ep_dequeue(cdev->gadget->ep0, cdev->req);
kfree(cdev->req->buf);
+ cdev->req->buf = NULL;
usb_ep_free_request(cdev->gadget->ep0, cdev->req);
+ cdev->req = NULL;
}
cdev->next_string_id = 0;
device_remove_file(&cdev->gadget->dev, &dev_attr_suspended);
^ permalink raw reply related [flat|nested] 2+ messages in thread
* usb: gadget: composite: Fix double free memory bug
@ 2019-03-19 9:03 Manu Gautam
0 siblings, 0 replies; 2+ messages in thread
From: Manu Gautam @ 2019-03-19 9:03 UTC (permalink / raw)
To: Chandana Kishori Chiluveru; +Cc: linux-usb, linux-usb-owner
Hi,
On 2019-03-15 16:37, Chandana Kishori Chiluveru wrote:
> configfs_dev_cleanup function can double free os_desc
> and buffer when called from different context. For
> example, this can be called from composite_unbind() and
> when composite_bind() fails.
Shouldn't we instead fix the error path handling of composite_bind
and configfs_composite_bind?
> Fix this issue by setting
> request and buffer pointer to NULL after kfree.
>
> Signed-off-by: Chandana Kishori Chiluveru <cchiluve@codeaurora.org>
> ---
> drivers/usb/gadget/composite.c | 4 ++++
> 1 file changed, 4 insertions(+)
>
> diff --git a/drivers/usb/gadget/composite.c
> b/drivers/usb/gadget/composite.c
> index b8a1584..992f1e2 100644
> --- a/drivers/usb/gadget/composite.c
> +++ b/drivers/usb/gadget/composite.c
> @@ -2155,14 +2155,18 @@ void composite_dev_cleanup(struct
> usb_composite_dev *cdev)
> usb_ep_dequeue(cdev->gadget->ep0, cdev->os_desc_req);
>
> kfree(cdev->os_desc_req->buf);
> + cdev->os_desc_req->buf = NULL;
> usb_ep_free_request(cdev->gadget->ep0, cdev->os_desc_req);
> + cdev->os_desc_req = NULL;
Better to move os_desc_cleanup handling to a different function
say - composite_os_desc_req_cleanup (to match
composite_os_desc_req_prepare())
> }
> if (cdev->req) {
> if (cdev->setup_pending)
> usb_ep_dequeue(cdev->gadget->ep0, cdev->req);
>
> kfree(cdev->req->buf);
> + cdev->req->buf = NULL;
> usb_ep_free_request(cdev->gadget->ep0, cdev->req);
> + cdev->req = NULL;
> }
> cdev->next_string_id = 0;
> device_remove_file(&cdev->gadget->dev, &dev_attr_suspended);
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2019-03-19 9:03 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2019-03-19 9:03 usb: gadget: composite: Fix double free memory bug Manu Gautam
-- strict thread matches above, loose matches on Subject: below --
2019-03-15 11:07 Chandana Kishori Chiluveru
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).