aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorAlexey Khoroshilov <khoroshilov@ispras.ru>2014-08-10 23:35:11 +0700
committerFelipe Balbi <balbi@ti.com>2014-08-19 09:21:46 -0500
commit4958cf32f66df854b932b601eef2da3f95973339 (patch)
tree4e007ad37a752652594d1c549c681b226881ca32
parent0c5824083b8ca4aff083dc74024d0bfd46f9da9d (diff)
usb: dbgp gadget: fix use after free in dbgp_unbind()
After dbgp_bind()-dbgp_unbind() cycle happens, static variable dbgp contains pointers to already deallocated memory (dbgp.serial and dbgp.req). If the next dbgp_bind() fails, for example in usb_ep_alloc_request(), dbgp_bind() calls dbgp_unbind() on failure path, and dbgp_unbind() frees dbgp.serial that still stores a pointer to already deallocated memory. The patch sets pointers to NULL in dbgp_unbind(). Found by Linux Driver Verification project (linuxtesting.org). Signed-off-by: Alexey Khoroshilov <khoroshilov@ispras.ru> Signed-off-by: Felipe Balbi <balbi@ti.com>
-rw-r--r--drivers/usb/gadget/legacy/dbgp.c2
1 files changed, 2 insertions, 0 deletions
diff --git a/drivers/usb/gadget/legacy/dbgp.c b/drivers/usb/gadget/legacy/dbgp.c
index 986fc51..225e385 100644
--- a/drivers/usb/gadget/legacy/dbgp.c
+++ b/drivers/usb/gadget/legacy/dbgp.c
@@ -222,10 +222,12 @@ static void dbgp_unbind(struct usb_gadget *gadget)
{
#ifdef CONFIG_USB_G_DBGP_SERIAL
kfree(dbgp.serial);
+ dbgp.serial = NULL;
#endif
if (dbgp.req) {
kfree(dbgp.req->buf);
usb_ep_free_request(gadget->ep0, dbgp.req);
+ dbgp.req = NULL;
}
gadget->ep0->driver_data = NULL;