Yavuz, Tuba 628d00a9e1 USB: gadget: f_midi: fixing a possible double-free in f_midi ... It looks like there is a possibility of a double-free vulnerability on an error path of the f_midi_set_alt function in the f_midi driver. If the path is feasible then free_ep_req gets called twice: req->complete = f_midi_complete; err = usb_ep_queue(midi->out_ep, req, GFP_ATOMIC); => ... usb_gadget_giveback_request => f_midi_complete (CALLBACK) (inside f_midi_complete, for various cases of status) free_ep_req(ep, req); // first kfree if (err) { ERROR(midi, "%s: couldn't enqueue request: %d\n", midi->out_ep->name, err); free_ep_req(midi->out_ep, req); // second kfree return err; } The double-free possibility was introduced with commit ad0d1a058eac ("usb: gadget: f_midi: fix leak on failed to enqueue out requests"). Found by MOXCAFE tool. Signed-off-by: Tuba Yavuz <tuba@ece.ufl.edu> Fixes: ad0d1a058eac ("usb: gadget: f_midi: fix leak on failed to enqueue out requests") Acked-by: Felipe Balbi <felipe.balbi@linux.intel.com> Cc: stable <stable@vger.kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Change-Id: I93342475b7e72ae44fed7d7c8f92d5f8dbf53c8a		2019-12-07 19:20:29 +01:00
..
Kconfig	Import latest Samsung release	2017-04-18 03:43:52 +02:00
Makefile	Import latest Samsung release	2017-04-18 03:43:52 +02:00
acm_ms.c	…
amd5536udc.c	…
amd5536udc.h	…
android.c	Merge tag 'LA.BR.1.3.6-03510-8976.0' into HEAD	2017-04-18 12:11:50 +02:00
at91_udc.c	…
at91_udc.h	…
atmel_usba_udc.c	…
atmel_usba_udc.h	…
audio.c	…
bcm63xx_udc.c	…
cdc2.c	…
ci13xxx_msm.c	USB: gadget: Set pm_qos_req-> type to AFFINITY_IRQ for android device	2015-10-19 21:29:09 -07:00
ci13xxx_msm_hsic.c	Merge tag 'LA.BR.1.3.6-03510-8976.0' into HEAD	2017-04-18 12:11:50 +02:00
ci13xxx_udc.c	drivers/usb/gadget: ci13xxx: Fix non-debug build	2017-04-18 12:16:13 +02:00
ci13xxx_udc.h	USB: ci13xxx_udc: Enable usb core and iface clock before reading registers	2015-05-27 21:45:11 -07:00
composite.c	usb: gadget: don't dereference g until after it has been null checked	2019-07-27 21:46:12 +02:00
config.c	…
configfs.c	Merge tag 'LA.BR.1.3.6-03510-8976.0' into HEAD	2017-04-18 12:11:50 +02:00
dbgp.c	…
debug.c	USB: Debug: Add centralized debug buffer for USB drivers	2015-04-21 22:02:54 -07:00
debug.h	USB: Debug: Add centralized debug buffer for USB drivers	2015-04-21 22:02:54 -07:00
dummy_hcd.c	usb: gadget: dummy: fix nonsensical comparisons	2019-07-27 21:45:52 +02:00
epautoconf.c	…
ether.c	…
f_accessory.c	Merge tag 'LA.BR.1.3.6-03510-8976.0' into HEAD	2017-04-18 12:11:50 +02:00
f_acm.c	ACM gadget: fix endianness in notifications	2019-07-27 21:44:04 +02:00
f_audio_source.c	…
f_ccid.c	…
f_ccid.h	…
f_charger.c	…
f_conn_gadget.c	Import latest Samsung release	2017-04-18 03:43:52 +02:00
f_conn_gadget_ioctl.h	Import latest Samsung release	2017-04-18 03:43:52 +02:00
f_diag.c	Import latest Samsung release	2017-04-18 03:43:52 +02:00
f_ecm.c	…
f_eem.c	…
f_fs.c	usb: f_fs: set ep->driver_data on unbind	2019-07-27 22:09:30 +02:00
f_gps.c	Merge tag 'LA.BR.1.3.6-03510-8976.0' into HEAD	2017-04-18 12:11:50 +02:00
f_hid.c	usb: gadget: f_hid: fix: Prevent accessing released memory	2019-07-27 21:50:04 +02:00
f_loopback.c	…
f_mass_storage.c	usb: gadget: mass_storage: added sysfs entry for cdrom to LUNs	2017-04-18 12:23:29 +02:00
f_mbim.c	Import latest Samsung release	2017-04-18 03:43:52 +02:00
f_midi.c	USB: gadget: f_midi: fixing a possible double-free in f_midi	2019-12-07 19:20:29 +01:00
f_mtp.c	ANDROID: usb: gadget: f_mtp: Return error if count is negative	2017-12-22 20:26:00 +00:00
f_mtp.h	Import latest Samsung release	2017-04-18 03:43:52 +02:00
f_mtp_samsung.c	Import latest Samsung release	2017-04-18 03:43:52 +02:00
f_ncm.c	Import latest Samsung release	2017-04-18 03:43:52 +02:00
f_obex.c	…
f_phonet.c	…
f_qc_ecm.c	…
f_qc_rndis.c	Merge tag 'LA.BR.1.3.6-04010-8976.0' of https://source.codeaurora.org/quic/la/kernel/msm-3.10 into HEAD	2017-06-09 23:21:11 +02:00
f_qdss.c	Merge tag 'LA.BR.1.3.6-03510-8976.0' into HEAD	2017-04-18 12:11:50 +02:00
f_qdss.h	…
f_rmnet.c	Merge tag 'LA.BR.1.3.6-03510-8976.0' into HEAD	2017-04-18 12:11:50 +02:00
f_rmnet_smd.c	…
f_rndis.c	Import latest Samsung release	2017-04-18 03:43:52 +02:00
f_serial.c	Merge tag 'LA.BR.1.3.6-03510-8976.0' into HEAD	2017-04-18 12:11:50 +02:00
f_sourcesink.c	…
f_subset.c	…
f_uac1.c	usb: gadget: uac1: Fix redefinition conflict for ac interface	2015-10-12 02:12:02 -07:00
f_uac2.c	…
f_uvc.c	…
f_uvc.h	…
fsl_mxc_udc.c	…
fsl_qe_udc.c	…
fsl_qe_udc.h	…
fsl_udc_core.c	…
fsl_usb2_udc.h	…
functions.c	…
fusb300_udc.c	…
fusb300_udc.h	…
g_ffs.c	…
g_zero.h	…
gadget_chips.h	…
gmidi.c	…
goku_udc.c	…
goku_udc.h	…
hid.c	…
imx_udc.c	…
imx_udc.h	…
inode.c	USB: gadgetfs, dummy-hcd, net2280: fix locking for callbacks	2019-07-27 21:45:33 +02:00
lpc32xx_udc.c	…
m66592-udc.c	…
m66592-udc.h	…
mass_storage.c	…
multi.c	…
multi_config.c	Import latest Samsung release	2017-04-18 03:43:52 +02:00
multi_config.h	Import latest Samsung release	2017-04-18 03:43:52 +02:00
mv_u3d.h	…
mv_u3d_core.c	…
mv_udc.h	…
mv_udc_core.c	…
ncm.c	…
ndis.h	…
net2272.c	…
net2272.h	…
net2280.c	USB: gadgetfs, dummy-hcd, net2280: fix locking for callbacks	2019-07-27 21:45:33 +02:00
net2280.h	…
nokia.c	…
omap_udc.c	…
omap_udc.h	…
pch_udc.c	…
printer.c	usb: gadget: printer: enqueue printer's response for setup request	2015-05-13 05:15:42 -07:00
pxa25x_udc.c	…
pxa25x_udc.h	…
pxa27x_udc.c	…
pxa27x_udc.h	…
r8a66597-udc.c	…
r8a66597-udc.h	…
rndis.c	…
rndis.h	…
s3c-hsotg.c	…
s3c-hsotg.h	…
s3c-hsudc.c	…
s3c2410_udc.c	…
s3c2410_udc.h	…
serial.c	…
storage_common.c	usb: gadget: mass_storage: added sysfs entry for cdrom to LUNs	2017-04-18 12:23:29 +02:00
tcm_usb_gadget.c	…
u_bam.c	Merge tag 'LA.BR.1.3.6-03510-8976.0' into HEAD	2017-04-18 12:11:50 +02:00
u_bam_data.c	Merge tag 'LA.BR.1.3.6-03510-8976.0' into HEAD	2017-04-18 12:11:50 +02:00
u_bam_data.h	…
u_ctrl_hsic.c	Import latest Samsung release	2017-04-18 03:43:52 +02:00
u_ctrl_hsuart.c	Merge tag 'LA.BR.1.3.6-03510-8976.0' into HEAD	2017-04-18 12:11:50 +02:00
u_ctrl_qti.c	Merge tag 'LA.BR.1.3.6-03510-8976.0' into HEAD	2017-04-18 12:11:50 +02:00
u_data_hsic.c	Merge tag 'LA.BR.1.3.6-03510-8976.0' into HEAD	2017-04-18 12:11:50 +02:00
u_data_hsuart.c	Merge tag 'LA.BR.1.3.6-03510-8976.0' into HEAD	2017-04-18 12:11:50 +02:00
u_data_ipa.c	Merge tag 'LA.BR.1.3.6-03510-8976.0' into HEAD	2017-04-18 12:11:50 +02:00
u_data_ipa.h	…
u_ether.c	Import latest Samsung release	2017-04-18 03:43:52 +02:00
u_ether.h	…
u_ncm.c	Import latest Samsung release	2017-04-18 03:43:52 +02:00
u_phonet.h	…
u_qc_ether.c	…
u_qc_ether.h	…
u_qdss.c	USB: Perform block reset during resume for recovery from flush failures	2015-07-12 04:05:16 -07:00
u_rmnet.h	…
u_rmnet_ctrl_smd.c	Merge tag 'LA.BR.1.3.6-03510-8976.0' into HEAD	2017-04-18 12:11:50 +02:00
u_serial.c	Merge tag 'LA.BR.1.3.6-03510-8976.0' into HEAD	2017-04-18 12:11:50 +02:00
u_serial.h	USB: f_serial/f_acm: Increase the IN endpoint buffer allocation	2015-07-24 16:39:43 +05:30
u_smd.c	Merge tag 'LA.BR.1.3.6-03510-8976.0' into HEAD	2017-04-18 12:11:50 +02:00
u_uac1.c	usb: gadget: audio: Set default sample_rate to 16KHz	2015-04-22 03:41:34 -07:00
u_uac1.h	…
udc-core.c	usb: gadget: Fix bug is queuing req upon Function Suspend	2015-06-04 12:59:04 -07:00
usb_gadget_xport.h	…
usbstring.c	…
uvc.h	…
uvc_queue.c	…
uvc_queue.h	…
uvc_v4l2.c	…
uvc_video.c	usb: gadget: composite: always set ep->mult to a sensible value	2019-07-27 21:43:35 +02:00
webcam.c	…
zero.c	…