android_kernel_samsung_msm8976/drivers/usb
Yavuz, Tuba 628d00a9e1 USB: gadget: f_midi: fixing a possible double-free in f_midi
It looks like there is a possibility of a double-free vulnerability on an
error path of the f_midi_set_alt function in the f_midi driver. If the
path is feasible then free_ep_req gets called twice:

         req->complete = f_midi_complete;
         err = usb_ep_queue(midi->out_ep, req, GFP_ATOMIC);
            => ...
             usb_gadget_giveback_request
               =>
                 f_midi_complete (CALLBACK)
                   (inside f_midi_complete, for various cases of status)
                   free_ep_req(ep, req); // first kfree
         if (err) {
                 ERROR(midi, "%s: couldn't enqueue request: %d\n",
                             midi->out_ep->name, err);
                 free_ep_req(midi->out_ep, req); // second kfree
                 return err;
         }

The double-free possibility was introduced with commit ad0d1a058eac
("usb: gadget: f_midi: fix leak on failed to enqueue out requests").

Found by MOXCAFE tool.

Signed-off-by: Tuba Yavuz <tuba@ece.ufl.edu>
Fixes: ad0d1a058eac ("usb: gadget: f_midi: fix leak on failed to enqueue out requests")
Acked-by: Felipe Balbi <felipe.balbi@linux.intel.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Change-Id: I93342475b7e72ae44fed7d7c8f92d5f8dbf53c8a
2019-12-07 19:20:29 +01:00
..
atm
c67x00
chipidea
class USB: check usb_get_extra_descriptor for proper size 2019-09-11 19:44:53 +02:00
core USB: check usb_get_extra_descriptor for proper size 2019-09-11 19:44:53 +02:00
dwc3 usb: dwc3: dbm: Fix double free in msm_dbm_probe 2019-07-27 21:50:40 +02:00
early Merge tag 'LA.BR.1.3.6-03510-8976.0' into HEAD 2017-04-18 12:11:50 +02:00
gadget USB: gadget: f_midi: fixing a possible double-free in f_midi 2019-12-07 19:20:29 +01:00
host USB: check usb_get_extra_descriptor for proper size 2019-09-11 19:44:53 +02:00
image
misc usb: usbtest: fix NULL pointer dereference 2019-07-27 21:45:16 +02:00
mon usb: usbmon: Read text within supplied buffer size 2019-09-11 19:44:53 +02:00
musb This is the 3.10.94 stable release 2017-04-18 17:12:56 +02:00
notify Import latest Samsung release 2017-04-18 03:43:52 +02:00
phy Merge tag 'LA.BR.1.3.6-04510-8976.0' of https://source.codeaurora.org/quic/la/kernel/msm-3.10 into HEAD 2017-08-06 13:38:06 +02:00
renesas_usbhs This is the 3.10.102 stable release 2017-04-18 17:22:08 +02:00
serial USB: serial: fix memleak in driver-registration error path 2019-07-27 21:42:16 +02:00
storage usb-storage: fix bogus hardware error messages for ATA pass-thru devices 2019-07-27 21:45:53 +02:00
wusbcore
Kconfig Import latest Samsung release 2017-04-18 03:43:52 +02:00
Makefile Import latest Samsung release 2017-04-18 03:43:52 +02:00
README
usb-common.c
usb-skeleton.c

README

To understand all the Linux-USB framework, you'll use these resources:

    * This source code.  This is necessarily an evolving work, and
      includes kerneldoc that should help you get a current overview.
      ("make pdfdocs", and then look at "usb.pdf" for host side and
      "gadget.pdf" for peripheral side.)  Also, Documentation/usb has
      more information.

    * The USB 2.0 specification (from www.usb.org), with supplements
      such as those for USB OTG and the various device classes.
      The USB specification has a good overview chapter, and USB
      peripherals conform to the widely known "Chapter 9".

    * Chip specifications for USB controllers.  Examples include
      host controllers (on PCs, servers, and more); peripheral
      controllers (in devices with Linux firmware, like printers or
      cell phones); and hard-wired peripherals like Ethernet adapters.

    * Specifications for other protocols implemented by USB peripheral
      functions.  Some are vendor-specific; others are vendor-neutral
      but just standardized outside of the www.usb.org team.

Here is a list of what each subdirectory here is, and what is contained in
them.

core/		- This is for the core USB host code, including the
		  usbfs files and the hub class driver ("khubd").

host/		- This is for USB host controller drivers.  This
		  includes UHCI, OHCI, EHCI, and others that might
		  be used with more specialized "embedded" systems.

gadget/		- This is for USB peripheral controller drivers and
		  the various gadget drivers which talk to them.


Individual USB driver directories.  A new driver should be added to the
first subdirectory in the list below that it fits into.

image/		- This is for still image drivers, like scanners or
		  digital cameras.
../input/	- This is for any driver that uses the input subsystem,
		  like keyboard, mice, touchscreens, tablets, etc.
../media/	- This is for multimedia drivers, like video cameras,
		  radios, and any other drivers that talk to the v4l
		  subsystem.
../net/		- This is for network drivers.
serial/		- This is for USB to serial drivers.
storage/	- This is for USB mass-storage drivers.
class/		- This is for all USB device drivers that do not fit
		  into any of the above categories, and work for a range
		  of USB Class specified devices. 
misc/		- This is for all USB device drivers that do not fit
		  into any of the above categories.