linux/drivers/usb
Andrew Gabbasov cdafb6d8b8 usb: gadget: f_fs: Fix use-after-free in ffs_free_inst
KASAN enabled configuration reports an error

BUG: KASAN: use-after-free in ffs_free_inst+... [usb_f_fs] at addr ...
Write of size 8 by task ...

This is observed after "ffs-test" is run and interrupted. If after that
functionfs is unmounted and g_ffs module is unloaded, that use-after-free
occurs during g_ffs module removal.

Although the report indicates ffs_free_inst() function, the actual
use-after-free condition occurs in _ffs_free_dev() function, which
is probably inlined into ffs_free_inst().

This happens due to keeping the ffs_data reference in device structure
during functionfs unmounting, while ffs_data itself is freed as no longer
needed. The fix is to clear that reference in ffs_closed() function,
which is a counterpart of ffs_ready(), where the reference is stored.

Fixes: 3262ad8243 ("usb: gadget: f_fs: Stop ffs_closed NULL pointer dereference")
Cc: stable@vger.kernel.org
Signed-off-by: Andrew Gabbasov <andrew_gabbasov@mentor.com>
Acked-by: Felipe Balbi <felipe.balbi@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-11-09 13:12:23 +01:00
..
atm USB: atm: Remove redundant license text 2017-11-04 11:55:38 +01:00
c67x00 USB: add SPDX identifiers to all remaining Makefiles 2017-11-07 15:53:48 +01:00
chipidea USB: chipidea: ci_hdrc_tegra.c: add SPDX line 2017-11-07 15:53:48 +01:00
class USB: add SPDX identifiers to all remaining Makefiles 2017-11-07 15:53:48 +01:00
common USB: common: Remove redundant license text 2017-11-04 11:55:39 +01:00
core USB: usbfs: compute urb->actual_length for isochronous 2017-11-09 13:02:23 +01:00
dwc2 USB: dwc2: Remove redundant license text 2017-11-07 15:45:01 +01:00
dwc3 USB: dwc3: Remove redundant license text 2017-11-07 15:45:01 +01:00
early USB: add SPDX identifiers to all remaining Makefiles 2017-11-07 15:53:48 +01:00
gadget usb: gadget: f_fs: Fix use-after-free in ffs_free_inst 2017-11-09 13:12:23 +01:00
host USB: host: xhci-debugfs: add SPDX lines 2017-11-07 15:53:48 +01:00
image USB: add SPDX identifiers to all remaining Makefiles 2017-11-07 15:53:48 +01:00
isp1760 USB: add SPDX identifiers to all remaining Makefiles 2017-11-07 15:53:48 +01:00
misc USB: add SPDX identifiers to all remaining Makefiles 2017-11-07 15:53:48 +01:00
mon USB: add SPDX identifiers to all remaining Makefiles 2017-11-07 15:53:48 +01:00
mtu3 USB: mtu3: Remove redundant license text 2017-11-07 15:45:01 +01:00
musb USB: musb: Remove redundant license text 2017-11-07 15:45:01 +01:00
phy USB: phy: Remove redundant license text 2017-11-07 15:45:01 +01:00
renesas_usbhs USB: renesas_usbhs: rcar?.h: add SPDX tags 2017-11-07 15:53:48 +01:00
serial USB: add SPDX identifiers to all remaining Makefiles 2017-11-07 15:53:48 +01:00
storage USB: storage: Remove redundant license text 2017-11-04 11:55:38 +01:00
typec USB: typec: Remove remaining redundant license text 2017-11-07 15:53:48 +01:00
usbip USB: usbip: Remove redundant license text 2017-11-07 15:45:01 +01:00
wusbcore USB: wusbcore: Remove redundant license text 2017-11-07 15:45:01 +01:00
Kconfig usb: Kconfig: clarify use of USB_PCI 2017-11-01 17:16:43 +01:00
Makefile USB patches for 4.12-rc1 2017-05-04 18:03:51 -07:00
README
usb-skeleton.c USB: usb-skeleton: Remove redundant license text 2017-11-04 11:55:39 +01:00

To understand all the Linux-USB framework, you'll use these resources:

    * This source code.  This is necessarily an evolving work, and
      includes kerneldoc that should help you get a current overview.
      ("make pdfdocs", and then look at "usb.pdf" for host side and
      "gadget.pdf" for peripheral side.)  Also, Documentation/usb has
      more information.

    * The USB 2.0 specification (from www.usb.org), with supplements
      such as those for USB OTG and the various device classes.
      The USB specification has a good overview chapter, and USB
      peripherals conform to the widely known "Chapter 9".

    * Chip specifications for USB controllers.  Examples include
      host controllers (on PCs, servers, and more); peripheral
      controllers (in devices with Linux firmware, like printers or
      cell phones); and hard-wired peripherals like Ethernet adapters.

    * Specifications for other protocols implemented by USB peripheral
      functions.  Some are vendor-specific; others are vendor-neutral
      but just standardized outside of the www.usb.org team.

Here is a list of what each subdirectory here is, and what is contained in
them.

core/		- This is for the core USB host code, including the
		  usbfs files and the hub class driver ("hub_wq").

host/		- This is for USB host controller drivers.  This
		  includes UHCI, OHCI, EHCI, and others that might
		  be used with more specialized "embedded" systems.

gadget/		- This is for USB peripheral controller drivers and
		  the various gadget drivers which talk to them.


Individual USB driver directories.  A new driver should be added to the
first subdirectory in the list below that it fits into.

image/		- This is for still image drivers, like scanners or
		  digital cameras.
../input/	- This is for any driver that uses the input subsystem,
		  like keyboard, mice, touchscreens, tablets, etc.
../media/	- This is for multimedia drivers, like video cameras,
		  radios, and any other drivers that talk to the v4l
		  subsystem.
../net/		- This is for network drivers.
serial/		- This is for USB to serial drivers.
storage/	- This is for USB mass-storage drivers.
class/		- This is for all USB device drivers that do not fit
		  into any of the above categories, and work for a range
		  of USB Class specified devices. 
misc/		- This is for all USB device drivers that do not fit
		  into any of the above categories.