summaryrefslogtreecommitdiff
path: root/drivers/phy/marvell
diff options
context:
space:
mode:
authorAndrew Gabbasov <andrew_gabbasov@mentor.com>2017-11-08 20:13:15 +0300
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>2017-11-09 15:12:23 +0300
commitcdafb6d8b8da7fde266f79b3287ac221aa841879 (patch)
tree2502542ce3bef8ab0e9cd5eefaad2f6d8de11711 /drivers/phy/marvell
parent2ef47001b3ee3ded579b7532ebdcf8680e4d8c54 (diff)
downloadlinux-cdafb6d8b8da7fde266f79b3287ac221aa841879.tar.xz
usb: gadget: f_fs: Fix use-after-free in ffs_free_inst
KASAN enabled configuration reports an error BUG: KASAN: use-after-free in ffs_free_inst+... [usb_f_fs] at addr ... Write of size 8 by task ... This is observed after "ffs-test" is run and interrupted. If after that functionfs is unmounted and g_ffs module is unloaded, that use-after-free occurs during g_ffs module removal. Although the report indicates ffs_free_inst() function, the actual use-after-free condition occurs in _ffs_free_dev() function, which is probably inlined into ffs_free_inst(). This happens due to keeping the ffs_data reference in device structure during functionfs unmounting, while ffs_data itself is freed as no longer needed. The fix is to clear that reference in ffs_closed() function, which is a counterpart of ffs_ready(), where the reference is stored. Fixes: 3262ad824307 ("usb: gadget: f_fs: Stop ffs_closed NULL pointer dereference") Cc: stable@vger.kernel.org Signed-off-by: Andrew Gabbasov <andrew_gabbasov@mentor.com> Acked-by: Felipe Balbi <felipe.balbi@linux.intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers/phy/marvell')
0 files changed, 0 insertions, 0 deletions