USB: gadget: f_midi: fixing a possible double-free in f_midi
It looks like there is a possibility of a double-free vulnerability on an error path of the f_midi_set_alt function in the f_midi driver. If the path is feasible then free_ep_req gets called twice: req->complete = f_midi_complete; err = usb_ep_queue(midi->out_ep, req, GFP_ATOMIC); => ... usb_gadget_giveback_request => f_midi_complete (CALLBACK) (inside f_midi_complete, for various cases of status) free_ep_req(ep, req); // first kfree if (err) { ERROR(midi, "%s: couldn't enqueue request: %d\n", midi->out_ep->name, err); free_ep_req(midi->out_ep, req); // second kfree return err; } The double-free possibility was introduced with commit ad0d1a058eac ("usb: gadget: f_midi: fix leak on failed to enqueue out requests"). Found by MOXCAFE tool. Signed-off-by: Tuba Yavuz <tuba@ece.ufl.edu> Fixes: ad0d1a058eac ("usb: gadget: f_midi: fix leak on failed to enqueue out requests") Acked-by: Felipe Balbi <felipe.balbi@linux.intel.com> Cc: stable <stable@vger.kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Change-Id: I93342475b7e72ae44fed7d7c8f92d5f8dbf53c8a
This commit is contained in:
parent
02c9e1032a
commit
628d00a9e1
|
@ -214,7 +214,9 @@ static struct usb_request *midi_alloc_ep_req(struct usb_ep *ep, unsigned length)
|
||||||
|
|
||||||
static void midi_free_ep_req(struct usb_ep *ep, struct usb_request *req)
|
static void midi_free_ep_req(struct usb_ep *ep, struct usb_request *req)
|
||||||
{
|
{
|
||||||
|
WARN_ON(req->buf == NULL);
|
||||||
kfree(req->buf);
|
kfree(req->buf);
|
||||||
|
req->buf = NULL;
|
||||||
usb_ep_free_request(ep, req);
|
usb_ep_free_request(ep, req);
|
||||||
}
|
}
|
||||||
|
|
||||||
|
@ -379,7 +381,8 @@ static int f_midi_set_alt(struct usb_function *f, unsigned intf, unsigned alt)
|
||||||
if (err) {
|
if (err) {
|
||||||
ERROR(midi, "%s: couldn't enqueue request: %d\n",
|
ERROR(midi, "%s: couldn't enqueue request: %d\n",
|
||||||
midi->out_ep->name, err);
|
midi->out_ep->name, err);
|
||||||
midi_free_ep_req(midi->out_ep, req);
|
if (req->buf != NULL)
|
||||||
|
midi_free_ep_req(midi->out_ep, req);
|
||||||
return err;
|
return err;
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
Loading…
Reference in New Issue