AuxXxilium/linux_dsm_epyc7002
1
0
Fork 0
mirror of https://github.com/AuxXxilium/linux_dsm_epyc7002.git synced 2024-12-28 03:58:02 +07:00
Code Issues Actions Packages Projects Releases Wiki Activity
cdafb6d8b8
linux_dsm_epyc7002/drivers/usb/gadget/function
History
Andrew Gabbasov cdafb6d8b8 usb: gadget: f_fs: Fix use-after-free in ffs_free_inst 
KASAN enabled configuration reports an error

BUG: KASAN: use-after-free in ffs_free_inst+... [usb_f_fs] at addr ...
Write of size 8 by task ...

This is observed after "ffs-test" is run and interrupted. If after that
functionfs is unmounted and g_ffs module is unloaded, that use-after-free
occurs during g_ffs module removal.

Although the report indicates ffs_free_inst() function, the actual
use-after-free condition occurs in _ffs_free_dev() function, which
is probably inlined into ffs_free_inst().

This happens due to keeping the ffs_data reference in device structure
during functionfs unmounting, while ffs_data itself is freed as no longer
needed. The fix is to clear that reference in ffs_closed() function,
which is a counterpart of ffs_ready(), where the reference is stored.

Fixes: 3262ad8243 ("usb: gadget: f_fs: Stop ffs_closed NULL pointer dereference")
Cc: stable@vger.kernel.org
Signed-off-by: Andrew Gabbasov <andrew_gabbasov@mentor.com>
Acked-by: Felipe Balbi <felipe.balbi@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-11-09 13:12:23 +01:00
..
f_acm.c USB: gadget: function: Remove redundant license text 2017-11-07 15:45:02 +01:00
f_ecm.c USB: gadget: function: Remove redundant license text 2017-11-07 15:45:02 +01:00
f_eem.c USB: gadget: function: Remove redundant license text 2017-11-07 15:45:02 +01:00
f_fs.c usb: gadget: f_fs: Fix use-after-free in ffs_free_inst 2017-11-09 13:12:23 +01:00
f_hid.c USB: gadget: function: Remove redundant license text 2017-11-07 15:45:02 +01:00
f_loopback.c USB: gadget: function: Remove redundant license text 2017-11-07 15:45:02 +01:00
f_mass_storage.c USB: add SPDX identifiers to all remaining files in drivers/usb/ 2017-11-04 11:48:02 +01:00
f_mass_storage.h USB: g_mass_storage: Fix deadlock when driver is unbound 2017-09-22 18:29:00 +02:00
f_midi.c USB: gadget: function: Remove redundant license text 2017-11-07 15:45:02 +01:00
f_ncm.c USB: gadget: function: Remove redundant license text 2017-11-07 15:45:02 +01:00
f_obex.c USB: gadget: function: Remove redundant license text 2017-11-07 15:45:02 +01:00
f_phonet.c USB: gadget: function: Remove redundant license text 2017-11-07 15:45:02 +01:00
f_printer.c USB: gadget: function: Remove redundant license text 2017-11-07 15:45:02 +01:00
f_rndis.c USB: gadget: function: Remove redundant license text 2017-11-07 15:45:02 +01:00
f_serial.c USB: gadget: function: Remove redundant license text 2017-11-07 15:45:02 +01:00
f_sourcesink.c USB: gadget: function: Remove redundant license text 2017-11-07 15:45:02 +01:00
f_subset.c USB: gadget: function: Remove redundant license text 2017-11-07 15:45:02 +01:00
f_tcm.c USB: gadget: function: Remove redundant license text 2017-11-07 15:45:02 +01:00
f_uac1_legacy.c USB: gadget: function: Remove redundant license text 2017-11-07 15:45:02 +01:00
f_uac1.c USB: gadget: function: Remove redundant license text 2017-11-07 15:45:02 +01:00
f_uac2.c USB: gadget: function: Remove redundant license text 2017-11-07 15:45:02 +01:00
f_uvc.c USB: gadget: function: Remove redundant license text 2017-11-07 15:45:02 +01:00
f_uvc.h USB: gadget: function: Remove redundant license text 2017-11-07 15:45:02 +01:00
g_zero.h usb: gadget: define free_ep_req as universal function 2015-12-15 09:12:41 -06:00
Makefile usb: gadget: add f_uac1 variant based on a new u_audio api 2017-06-19 09:22:47 +03:00
ndis.h
rndis.c USB: gadget: function: Remove redundant license text 2017-11-07 15:45:02 +01:00
rndis.h USB: gadget: function: Remove redundant license text 2017-11-07 15:45:02 +01:00
storage_common.c USB: gadget: function: Remove redundant license text 2017-11-07 15:45:02 +01:00
storage_common.h USB: f_mass_storage: improve memory barriers and synchronization 2017-05-16 10:38:33 +03:00
tcm.h usb-gadget/tcm: Conversion to percpu_ida tag pre-allocation 2016-03-10 21:48:14 -08:00
u_audio.c USB: gadget: function: Remove redundant license text 2017-11-07 15:45:02 +01:00
u_audio.h USB: gadget: function: Remove redundant license text 2017-11-07 15:45:02 +01:00
u_ecm.h USB: gadget: function: Remove redundant license text 2017-11-07 15:45:02 +01:00
u_eem.h USB: gadget: function: Remove redundant license text 2017-11-07 15:45:02 +01:00
u_ether_configfs.h USB: gadget: function: Remove redundant license text 2017-11-07 15:45:02 +01:00
u_ether.c USB: gadget: function: Remove redundant license text 2017-11-07 15:45:02 +01:00
u_ether.h USB: gadget: function: Remove redundant license text 2017-11-07 15:45:02 +01:00
u_fs.h USB: gadget: function: Remove redundant license text 2017-11-07 15:45:02 +01:00
u_gether.h USB: gadget: function: Remove redundant license text 2017-11-07 15:45:02 +01:00
u_hid.h USB: gadget: function: Remove redundant license text 2017-11-07 15:45:02 +01:00
u_midi.h USB: gadget: function: Remove redundant license text 2017-11-07 15:45:02 +01:00
u_ncm.h USB: gadget: function: Remove redundant license text 2017-11-07 15:45:02 +01:00
u_phonet.h USB: gadget: function: Remove redundant license text 2017-11-07 15:45:02 +01:00
u_printer.h USB: gadget: function: Remove redundant license text 2017-11-07 15:45:02 +01:00
u_rndis.h USB: gadget: function: Remove redundant license text 2017-11-07 15:45:02 +01:00
u_serial.c USB: gadget: function: Remove redundant license text 2017-11-07 15:45:02 +01:00
u_serial.h USB: gadget: function: Remove redundant license text 2017-11-07 15:45:02 +01:00
u_tcm.h USB: gadget: function: Remove redundant license text 2017-11-07 15:45:02 +01:00
u_uac1_legacy.c USB: gadget: function: Remove redundant license text 2017-11-07 15:45:02 +01:00
u_uac1_legacy.h USB: gadget: function: Remove redundant license text 2017-11-07 15:45:02 +01:00
u_uac1.h USB: gadget: function: Remove redundant license text 2017-11-07 15:45:02 +01:00
u_uac2.h USB: gadget: function: Remove redundant license text 2017-11-07 15:45:02 +01:00
u_uvc.h USB: gadget: function: Remove redundant license text 2017-11-07 15:45:02 +01:00
uvc_configfs.c USB: gadget: function: Remove redundant license text 2017-11-07 15:45:02 +01:00
uvc_configfs.h USB: gadget: function: Remove redundant license text 2017-11-07 15:45:02 +01:00
uvc_queue.c USB: gadget: function: Remove redundant license text 2017-11-07 15:45:02 +01:00
uvc_queue.h [media] media: videobuf2: Restructure vb2_buffer 2015-10-01 09:04:43 -03:00
uvc_v4l2.c USB: gadget: function: Remove redundant license text 2017-11-07 15:45:02 +01:00
uvc_v4l2.h USB: gadget: function: Remove redundant license text 2017-11-07 15:45:02 +01:00
uvc_video.c USB: gadget: function: Remove redundant license text 2017-11-07 15:45:02 +01:00
uvc_video.h USB: gadget: function: Remove redundant license text 2017-11-07 15:45:02 +01:00
uvc.h USB: gadget: function: Remove redundant license text 2017-11-07 15:45:02 +01:00