From bb16981daa8e633ea34867eb585537034e19494c Mon Sep 17 00:00:00 2001 From: Andrew Gabbasov Date: Wed, 8 Nov 2017 10:13:15 -0700 Subject: [PATCH] UPSTREAM: usb: gadget: f_fs: Fix use-after-free in ffs_free_inst KASAN enabled configuration reports an error BUG: KASAN: use-after-free in ffs_free_inst+... [usb_f_fs] at addr ... Write of size 8 by task ... This is observed after "ffs-test" is run and interrupted. If after that functionfs is unmounted and g_ffs module is unloaded, that use-after-free occurs during g_ffs module removal. Although the report indicates ffs_free_inst() function, the actual use-after-free condition occurs in _ffs_free_dev() function, which is probably inlined into ffs_free_inst(). This happens due to keeping the ffs_data reference in device structure during functionfs unmounting, while ffs_data itself is freed as no longer needed. The fix is to clear that reference in ffs_closed() function, which is a counterpart of ffs_ready(), where the reference is stored. Change-Id: Ia7d30dfe643ef5de184620b483ef3ad16a76d309 Fixes: 3262ad824307 ("usb: gadget: f_fs: Stop ffs_closed NULL pointer dereference") Cc: stable@vger.kernel.org Signed-off-by: Andrew Gabbasov Acked-by: Felipe Balbi Signed-off-by: Greg Kroah-Hartman Signed-off-by: William Wu (cherry picked from commit cdafb6d8b8da7fde266f79b3287ac221aa841879) --- drivers/usb/gadget/function/f_fs.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c index f613694b563e..5ca7271580d3 100644 --- a/drivers/usb/gadget/function/f_fs.c +++ b/drivers/usb/gadget/function/f_fs.c @@ -3478,6 +3478,7 @@ static void ffs_closed(struct ffs_data *ffs) goto done; ffs_obj->desc_ready = false; + ffs_obj->ffs_data = NULL; if (test_and_clear_bit(FFS_FL_CALL_CLOSED_CALLBACK, &ffs->flags) && ffs_obj->ffs_closed_callback)