From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH,DKIM_SIGNED, DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 45654C3A5A1 for ; Thu, 22 Aug 2019 17:45:59 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 1AA6320856 for ; Thu, 22 Aug 2019 17:45:59 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1566495959; bh=4gWfYNzBnOxEGicvWI82+pjLANlhKX0clIolvnuZ+Ow=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=T9MNqHOtU2qGKm03jVjeOQKPVydj+eW+ugCYDVhqCq2Jd3QeoOn7b2pRW3H4b+MIp F34F5lO7dsUhhC3QjHdXlv07uLRMS4LE2fV09Xw0kfVY8p+Wt9eKS3/grVjXA6hrXD lHc7c1x7wn5K9iu/CJgTWSUz+0keZfoazdE8Bsik= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2393037AbfHVRp6 (ORCPT ); Thu, 22 Aug 2019 13:45:58 -0400 Received: from mail.kernel.org ([198.145.29.99]:42050 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2391694AbfHVRW7 (ORCPT ); Thu, 22 Aug 2019 13:22:59 -0400 Received: from localhost (wsip-184-188-36-2.sd.sd.cox.net [184.188.36.2]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id D198223406; Thu, 22 Aug 2019 17:22:58 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1566494579; bh=4gWfYNzBnOxEGicvWI82+pjLANlhKX0clIolvnuZ+Ow=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=ZPMM0ZP1SxNI1SoBSrYbuWqObmOP4H0NTjNtM64FMmrcSRwVUwMKMzI+/vX7VPjO4 7+IZLBUowgq5+5Z93IKMeDd5H67V/0+RwicpJAKkPBb8Uqsd8GIwQ0NHt5tVJ/qBtL 1yGf10bxG/9IeHL4CVol0/TsfJiGjn83mi1eTkpo= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Tuba Yavuz , Felipe Balbi , Guenter Roeck Subject: [PATCH 4.4 35/78] USB: gadget: f_midi: fixing a possible double-free in f_midi Date: Thu, 22 Aug 2019 10:18:39 -0700 Message-Id: <20190822171833.060423953@linuxfoundation.org> X-Mailer: git-send-email 2.23.0 In-Reply-To: <20190822171832.012773482@linuxfoundation.org> References: <20190822171832.012773482@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Yavuz, Tuba commit 7fafcfdf6377b18b2a726ea554d6e593ba44349f upstream. It looks like there is a possibility of a double-free vulnerability on an error path of the f_midi_set_alt function in the f_midi driver. If the path is feasible then free_ep_req gets called twice: req->complete = f_midi_complete; err = usb_ep_queue(midi->out_ep, req, GFP_ATOMIC); => ... usb_gadget_giveback_request => f_midi_complete (CALLBACK) (inside f_midi_complete, for various cases of status) free_ep_req(ep, req); // first kfree if (err) { ERROR(midi, "%s: couldn't enqueue request: %d\n", midi->out_ep->name, err); free_ep_req(midi->out_ep, req); // second kfree return err; } The double-free possibility was introduced with commit ad0d1a058eac ("usb: gadget: f_midi: fix leak on failed to enqueue out requests"). Found by MOXCAFE tool. Signed-off-by: Tuba Yavuz Fixes: ad0d1a058eac ("usb: gadget: f_midi: fix leak on failed to enqueue out requests") Acked-by: Felipe Balbi Cc: stable Cc: Guenter Roeck Signed-off-by: Greg Kroah-Hartman --- drivers/usb/gadget/function/f_midi.c | 3 ++- drivers/usb/gadget/u_f.h | 2 ++ 2 files changed, 4 insertions(+), 1 deletion(-) --- a/drivers/usb/gadget/function/f_midi.c +++ b/drivers/usb/gadget/function/f_midi.c @@ -366,7 +366,8 @@ static int f_midi_set_alt(struct usb_fun if (err) { ERROR(midi, "%s: couldn't enqueue request: %d\n", midi->out_ep->name, err); - free_ep_req(midi->out_ep, req); + if (req->buf != NULL) + free_ep_req(midi->out_ep, req); return err; } } --- a/drivers/usb/gadget/u_f.h +++ b/drivers/usb/gadget/u_f.h @@ -65,7 +65,9 @@ struct usb_request *alloc_ep_req(struct /* Frees a usb_request previously allocated by alloc_ep_req() */ static inline void free_ep_req(struct usb_ep *ep, struct usb_request *req) { + WARN_ON(req->buf == NULL); kfree(req->buf); + req->buf = NULL; usb_ep_free_request(ep, req); }