From: Alan Stern <stern@rowland.harvard.edu>
To: Hangyu Hua <hbh25y@gmail.com>
Cc: balbi@kernel.org, gregkh@linuxfoundation.org, axboe@kernel.dk,
dan.carpenter@oracle.com, jj251510319013@gmail.com,
linux-usb@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: Re: [PATCH v4 2/2] usb: gadget: clear related members when goto fail
Date: Fri, 31 Dec 2021 12:35:03 -0500 [thread overview]
Message-ID: <Yc8/R4J0qYgXzkYn@rowland.harvard.edu> (raw)
In-Reply-To: <20211231172138.7993-3-hbh25y@gmail.com>
On Sat, Jan 01, 2022 at 01:21:38AM +0800, Hangyu Hua wrote:
> dev->config and dev->hs_config and dev->dev need to be cleaned if
> dev_config fails to avoid UAF.
>
> Signed-off-by: Hangyu Hua <hbh25y@gmail.com>
> ---
Acked-by: Alan Stern <stern@rowland.harvard.edu>
> drivers/usb/gadget/legacy/inode.c | 7 +++++--
> 1 file changed, 5 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/usb/gadget/legacy/inode.c b/drivers/usb/gadget/legacy/inode.c
> index eaad03c0252f..25c8809e0a38 100644
> --- a/drivers/usb/gadget/legacy/inode.c
> +++ b/drivers/usb/gadget/legacy/inode.c
> @@ -1875,8 +1875,8 @@ dev_config (struct file *fd, const char __user *buf, size_t len, loff_t *ptr)
>
> value = usb_gadget_probe_driver(&gadgetfs_driver);
> if (value != 0) {
> - kfree (dev->buf);
> - dev->buf = NULL;
> + spin_lock_irq(&dev->lock);
> + goto fail;
> } else {
> /* at this point "good" hardware has for the first time
> * let the USB the host see us. alternatively, if users
> @@ -1893,6 +1893,9 @@ dev_config (struct file *fd, const char __user *buf, size_t len, loff_t *ptr)
> return value;
>
> fail:
> + dev->config = NULL;
> + dev->hs_config = NULL;
> + dev->dev = NULL;
> spin_unlock_irq (&dev->lock);
> pr_debug ("%s: %s fail %zd, %p\n", shortname, __func__, value, dev);
> kfree (dev->buf);
> --
> 2.25.1
>
prev parent reply other threads:[~2021-12-31 17:35 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-12-31 17:21 [PATCH v4 0/2] usb: gadget: use after free in dev_config Hangyu Hua
2021-12-31 17:21 ` [PATCH v4 1/2] usb: gadget: don't release an existing dev->buf Hangyu Hua
2021-12-31 17:34 ` Alan Stern
2021-12-31 17:21 ` [PATCH v4 2/2] usb: gadget: clear related members when goto fail Hangyu Hua
2021-12-31 17:35 ` Alan Stern [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=Yc8/R4J0qYgXzkYn@rowland.harvard.edu \
--to=stern@rowland.harvard.edu \
--cc=axboe@kernel.dk \
--cc=balbi@kernel.org \
--cc=dan.carpenter@oracle.com \
--cc=gregkh@linuxfoundation.org \
--cc=hbh25y@gmail.com \
--cc=jj251510319013@gmail.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-usb@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.