From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754185AbdKIMBk (ORCPT ); Thu, 9 Nov 2017 07:01:40 -0500 Received: from out4-smtp.messagingengine.com ([66.111.4.28]:50057 "EHLO out4-smtp.messagingengine.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752667AbdKIMBi (ORCPT ); Thu, 9 Nov 2017 07:01:38 -0500 X-ME-Sender: Date: Thu, 9 Nov 2017 13:01:47 +0100 From: Greg KH To: Andrew Gabbasov Cc: Felipe Balbi , linux-usb@vger.kernel.org, linux-kernel@vger.kernel.org Subject: Re: [PATCH] usb: gadget: f_fs: Fix use-after-free in ffs_free_inst Message-ID: <20171109120147.GA7776@kroah.com> References: <1510161195-24838-1-git-send-email-andrew_gabbasov@mentor.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <1510161195-24838-1-git-send-email-andrew_gabbasov@mentor.com> User-Agent: Mutt/1.9.1 (2017-09-22) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Wed, Nov 08, 2017 at 10:13:15AM -0700, Andrew Gabbasov wrote: > KASAN enabled configuration reports an error > > BUG: KASAN: use-after-free in ffs_free_inst+... [usb_f_fs] at addr ... > Write of size 8 by task ... > > This is observed after "ffs-test" is run and interrupted. If after that > functionfs is unmounted and g_ffs module is unloaded, that use-after-free > occurs during g_ffs module removal. > > Although the report indicates ffs_free_inst() function, the actual > use-after-free condition occurs in _ffs_free_dev() function, which > is probably inlined into ffs_free_inst(). > > This happens due to keeping the ffs_data reference in device structure > during functionfs unmounting, while ffs_data itself is freed as no longer > needed. The fix is to clear that reference in ffs_closed() function, > which is a counterpart of ffs_ready(), where the reference is stored. > > Fixes: 3262ad824307 ("usb: gadget: f_fs: Stop ffs_closed NULL pointer dereference") > Cc: stable@vger.kernel.org > Signed-off-by: Andrew Gabbasov > --- > drivers/usb/gadget/function/f_fs.c | 1 + > 1 file changed, 1 insertion(+) Felipe, want me to take this directly? thanks, greg k-h