[PATCH usb-next] usb: gadget: f_rndis: prevent double-free of OS descriptor table

[PATCH usb-next] usb: gadget: f_rndis: prevent double-free of OS descriptor table

[Xinsheng Zhu]

rndis_bind() allocates an OS descriptor table only when
cdev->use_os_string is enabled. However, rndis_unbind() frees the
table and resets f->os_desc_n without clearing f->os_desc_table,
leaving a dangling pointer.

When a ConfigFS gadget is unbound, the function object can be reused
for a subsequent bind. OS descriptor support can be toggled through
the ConfigFS os_desc/use attribute, which determines
cdev->use_os_string on the next bind. If this flag changes from true
to false between binds, rndis_bind() skips the allocation and leaves
f->os_desc_table pointing to the previously freed memory.

A subsequent unbind may therefore free the stale pointer again,
resulting in a double-free.

Set f->os_desc_table to NULL after freeing it to prevent the stale
pointer from being reused across bind/unbind cycles.

Fixes: de7a8d2d534f ("usb: gadget: f_rndis: OS descriptors support")
Signed-off-by: Xinsheng Zhu <xinsheng.zhu.ny@gmail.com>
---
 drivers/usb/gadget/function/f_rndis.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/usb/gadget/function/f_rndis.c b/drivers/usb/gadget/function/f_rndis.c
index 7de1c5f8e326..b9e4dff9a12c 100644
--- a/drivers/usb/gadget/function/f_rndis.c
+++ b/drivers/usb/gadget/function/f_rndis.c
@@ -949,6 +949,7 @@ static void rndis_unbind(struct usb_configuration *c, struct usb_function *f)
 	rndis_opts = container_of(f->fi, struct f_rndis_opts, func_inst);
 
 	kfree(f->os_desc_table);
+	f->os_desc_table = NULL;
 	f->os_desc_n = 0;
 	usb_free_all_descriptors(f);
 

base-commit: 6628e7d4c6b25c8d18f1345e3a20d21829aae7e4
-- 
2.54.0 (Apple Git-157)

Re: [PATCH usb-next] usb: gadget: f_rndis: prevent double-free of OS descriptor table

[sashiko-bot]

> rndis_bind() allocates an OS descriptor table only when
> cdev->use_os_string is enabled. However, rndis_unbind() frees the
> table and resets f->os_desc_n without clearing f->os_desc_table,
> leaving a dangling pointer.
> 
> When a ConfigFS gadget is unbound, the function object can be reused
> for a subsequent bind. OS descriptor support can be toggled through
> the ConfigFS os_desc/use attribute, which determines
> cdev->use_os_string on the next bind. If this flag changes from true
> to false between binds, rndis_bind() skips the allocation and leaves
> f->os_desc_table pointing to the previously freed memory.
> 
> A subsequent unbind may therefore free the stale pointer again,
> resulting in a double-free.
> 
> Set f->os_desc_table to NULL after freeing it to prevent the stale
> pointer from being reused across bind/unbind cycles.
> 
> Fixes: de7a8d2d534f ("usb: gadget: f_rndis: OS descriptors support")
> Signed-off-by: Xinsheng Zhu <xinsheng.zhu.ny@gmail.com>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261109060018.71063-1-xinsheng.zhu.ny@gmail.com?part=1