Re: [PATCH] usb: gadget: function: use after free in printer_close()

From: Dan Carpenter <error27@gmail.com>
To: Andrzej Pietrasiewicz <andrzej.p@collabora.com>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
	Albert Briscoe <albertsbriscoe@gmail.com>,
	Zqiang <qiang.zhang@windriver.com>,
	Felipe Balbi <balbi@kernel.org>,
	linux-usb@vger.kernel.org, kernel-janitors@vger.kernel.org
Subject: Re: [PATCH] usb: gadget: function: use after free in printer_close()
Date: Tue, 22 Nov 2022 10:00:27 +0300	[thread overview]
Message-ID: <Y3xzi389jS0PmEBA@kadam> (raw)
In-Reply-To: <b7dcf498-51ea-3aaf-211f-09fa59c38768@collabora.com>

On Mon, Nov 21, 2022 at 04:32:52PM +0100, Andrzej Pietrasiewicz wrote:
> Hi Dan,
> 
> I'm fine with either symmetrically removing the DBG() from "printer_open()"
> or with this version of the patch.
> 
> It seems to me that this version better fits "fixing UAF", though.
> Whether the driver is too verbose is another matter, and if it is,
> it deserves its own patch because DBG() invocations are sprinkled
> here and there.

It is too verbose, but I'm trying to cut my kernel work to an hour a day
and then all day Friday so I don't have time to clean to do clean up
work.  A UAF is sort of high value but clean up is endless.

I obviously considered this as v1 but thought deleting was better.  I
still do.  :)  But it's not worth spending time on.

> 
> W dniu 21.11.2022 o 15:44, Dan Carpenter pisze:
> > The printer_dev_free() function frees "dev" but then it is dereferenced
> > by the debug code on the next line.  Flip the order to avoid the use after
> > free.
> > 
> > Fixes: e8d5f92b8d30 ("usb: gadget: function: printer: fix use-after-free in __lock_acquire")
> > Signed-off-by: Dan Carpenter <error27@gmail.com>
> 
> Acked-by: Andrzej Pietrasiewicz <andrzej.p@collabora.com>

Thanks!

regards,
dan carpenter