Patch "USB: UDC core: fix double-free in usb_add_gadget_udc_release" has been added to the 4.14-stable tree

PATCH [email protected] 1 participant 1 message Jan 14, 2018

Subsystems (2)

Stable branch USB

lore

Share & tools

lore

[email protected]

author maintainer Applied

2018-01-14 08:09 UTC #0 lore raw

This is a note to let you know that I've just added the patch titled

USB: UDC core: fix double-free in usb_add_gadget_udc_release

to the 4.14-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
usb-udc-core-fix-double-free-in-usb_add_gadget_udc_release.patch
and it can be found in the queue-4.14 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

Quoted 1 line

From 7ae2c3c280db183ca9ada2675c34ec2f7378abfa Mon Sep 17 00:00:00 2001

From: Alan Stern <[email protected]>
Date: Wed, 3 Jan 2018 12:51:51 -0500
Subject: USB: UDC core: fix double-free in usb_add_gadget_udc_release

From: Alan Stern <[email protected]>

commit 7ae2c3c280db183ca9ada2675c34ec2f7378abfa upstream.

The error-handling pathways in usb_add_gadget_udc_release() are messed up. Aside from the uninformative statement labels, they can deallocate the udc structure after calling put_device(), which is a double-free. This was observed by KASAN in automatic testing.

This patch cleans up the routine. It preserves the requirement that when any failure occurs, we call put_device(&gadget->dev).

Signed-off-by Alan Stern <[email protected]>

Reported-by Fengguang Wu <[email protected]>

Reviewed-by Peter Chen <[email protected]>

Acked-by Felipe Balbi <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/usb/gadget/udc/core.c |   28 +++++++++++++---------------
 1 file changed, 13 insertions(+), 15 deletions(-)

drivers/usb/gadget/udc/core.c +13 ~~-15~~

@@ -1158,11 +1158,7 @@ int usb_add_gadget_udc_release(struct de
 
 	udc = kzalloc(sizeof(*udc), GFP_KERNEL);
 	if (!udc)
-		goto err1;
-
-	ret = device_add(&gadget->dev);
-	if (ret)
-		goto err2;
+		goto err_put_gadget;
 
 	device_initialize(&udc->dev);
 	udc->dev.release = usb_udc_release;

@@ -1171,7 +1167,11 @@ int usb_add_gadget_udc_release(struct de
 	udc->dev.parent = parent;
 	ret = dev_set_name(&udc->dev, "%s", kobject_name(&parent->kobj));
 	if (ret)
-		goto err3;
+		goto err_put_udc;
+
+	ret = device_add(&gadget->dev);
+	if (ret)
+		goto err_put_udc;
 
 	udc->gadget = gadget;
 	gadget->udc = udc;

@@ -1181,7 +1181,7 @@ int usb_add_gadget_udc_release(struct de
 
 	ret = device_add(&udc->dev);
 	if (ret)
-		goto err4;
+		goto err_unlist_udc;
 
 	usb_gadget_set_state(gadget, USB_STATE_NOTATTACHED);
 	udc->vbus = true;

@@ -1189,27 +1189,25 @@ int usb_add_gadget_udc_release(struct de
 	/* pick up one of pending gadget drivers */
 	ret = check_pending_gadget_drivers(udc);
 	if (ret)
-		goto err5;
+		goto err_del_udc;
 
 	mutex_unlock(&udc_lock);
 
 	return 0;
 
-err5:
+ err_del_udc:
 	device_del(&udc->dev);
 
-err4:
+ err_unlist_udc:
 	list_del(&udc->list);
 	mutex_unlock(&udc_lock);
 
-err3:
-	put_device(&udc->dev);
 	device_del(&gadget->dev);
 
-err2:
-	kfree(udc);
+ err_put_udc:
+	put_device(&udc->dev);
 
-err1:
+ err_put_gadget:
 	put_device(&gadget->dev);
 	return ret;
 }

Patches currently in stable-queue which might be from [email protected] are

queue-4.14/usb-udc-core-fix-double-free-in-usb_add_gadget_udc_release.patch