[PATCH usb-next v2] usb: gadget: f_ncm: prevent double-free of OS descriptor table

[PATCH usb-next v2] usb: gadget: f_ncm: prevent double-free of OS descriptor table

[Xinsheng Zhu]

ncm_bind() allocates an OS descriptor table only when
cdev->use_os_string is enabled. However, ncm_unbind() frees the
table and resets f->os_desc_n without clearing f->os_desc_table,
leaving a dangling pointer.

When a ConfigFS gadget is unbound, the function object can be reused
for a subsequent bind. The OS descriptor support can be toggled
through the ConfigFS os_desc/use attribute, which determines
cdev->use_os_string on the next bind. If this flag changes from true
to false between binds, ncm_bind() skips the allocation and leaves
f->os_desc_table pointing to the previously freed memory.

A subsequent unbind may therefore free the stale pointer again,
resulting in a double-free.

Set f->os_desc_table to NULL after freeing it to prevent the stale
pointer from being reused across bind/unbind cycles.

Fixes: 793409292382 ("usb: gadget: f_ncm: Add OS descriptor support")
Signed-off-by: Xinsheng Zhu <xinsheng.zhu.ny@gmail.com>
---
Changes in v2:
- Add Fixes tag.

v1: https://lore.kernel.org/r/20261109053440.49156-1-xinsheng.zhu.ny@gmail.com

 drivers/usb/gadget/function/f_ncm.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/usb/gadget/function/f_ncm.c b/drivers/usb/gadget/function/f_ncm.c
index 500c9c19c78b..685152ec9a5d 100644
--- a/drivers/usb/gadget/function/f_ncm.c
+++ b/drivers/usb/gadget/function/f_ncm.c
@@ -1741,6 +1741,7 @@ static void ncm_unbind(struct usb_configuration *c, struct usb_function *f)
 	hrtimer_cancel(&ncm->task_timer);
 
 	kfree(f->os_desc_table);
+	f->os_desc_table = NULL;
 	f->os_desc_n = 0;
 
 	ncm_string_defs[0].id = 0;

base-commit: 6628e7d4c6b25c8d18f1345e3a20d21829aae7e4
-- 
2.54.0 (Apple Git-157)

Re: [PATCH usb-next v2] usb: gadget: f_ncm: prevent double-free of OS descriptor table

[sashiko-bot]

> ncm_bind() allocates an OS descriptor table only when
> cdev->use_os_string is enabled. However, ncm_unbind() frees the
> table and resets f->os_desc_n without clearing f->os_desc_table,
> leaving a dangling pointer.
> 
> When a ConfigFS gadget is unbound, the function object can be reused
> for a subsequent bind. The OS descriptor support can be toggled
> through the ConfigFS os_desc/use attribute, which determines
> cdev->use_os_string on the next bind. If this flag changes from true
> to false between binds, ncm_bind() skips the allocation and leaves
> f->os_desc_table pointing to the previously freed memory.
> 
> A subsequent unbind may therefore free the stale pointer again,
> resulting in a double-free.
> 
> Set f->os_desc_table to NULL after freeing it to prevent the stale
> pointer from being reused across bind/unbind cycles.
> 
> Fixes: 793409292382 ("usb: gadget: f_ncm: Add OS descriptor support")
> Signed-off-by: Xinsheng Zhu <xinsheng.zhu.ny@gmail.com>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261109061110.80422-1-xinsheng.zhu.ny@gmail.com?part=1