usb: gadget: Fix double free of device descriptor pointers
PATCH 1/1 usb: gadget: Fix double free of device descriptor pointers
From: Hemant Kumar <[email protected]>
Upon driver unbind usb_free_all_descriptors() function frees all speed descriptor pointers without setting them to NULL. In case gadget speed changes (i.e from super speed plus to super speed) after driver unbind only upto super speed descriptor pointers get populated. Super speed plus desc still holds the stale (already freed) pointer. Fix this issue by setting all descriptor pointers to NULL after freeing them in usb_free_all_descriptors().
--- drivers/usb/gadget/config.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/usb/gadget/config.c +4 -0
@@ -194,9 +194,13 @@ EXPORT_SYMBOL_GPL(usb_assign_descriptors);void usb_free_all_descriptors (struct usb_function *f) {usb_free_descriptors (f->fs_descriptors); + f->fs_descriptors =NULL ;usb_free_descriptors (f->hs_descriptors); + f->hs_descriptors =NULL ;usb_free_descriptors (f->ss_descriptors); + f->ss_descriptors =NULL ;usb_free_descriptors (f->ssp_descriptors); + f->ssp_descriptors =NULL ; }EXPORT_SYMBOL_GPL (usb_free_all_descriptors);
Signature · 2 lines
The Qualcomm Innovation Center, Inc. is a member of the Code Aurora Forum, a Linux Foundation Collaborative Project
Quoted 24 lines · Wesley Cheng
From: Hemant Kumar <[email protected]>
Upon driver unbind
usb_free_all_descriptors()function frees all speed descriptor pointers without setting them to NULL. In case gadget speed changes (i.e from super speed plus to super speed) after driver unbind only upto super speed descriptor pointers get populated. Super speed plus desc still holds the stale (already freed) pointer. Fix this issue by setting all descriptor pointers to NULL after freeing them inusb_free_all_descriptors().Signed-off-by Hemant Kumar <[email protected]>Signed-off-by Wesley Cheng <[email protected]>--- drivers/usb/gadget/config.c | 4 ++++ 1 file changed, 4 insertions(+)drivers/usb/gadget/config.c +0
-0@@ -194,9 +194,13 @@ EXPORT_SYMBOL_GPL(usb_assign_descriptors);void usb_free_all_descriptors (struct usb_function *f) {usb_free_descriptors (f->fs_descriptors);
drivers/usb/gadget/config.c EXPORT_SYMBOL_GPL(usb_assign_descriptors); · line 206
Quoted 10 lines
drivers/usb/gadget/config.c +4
-0+ f->fs_descriptors =NULL ;usb_free_descriptors (f->hs_descriptors); + f->hs_descriptors =NULL ;usb_free_descriptors (f->ss_descriptors); + f->ss_descriptors =NULL ;usb_free_descriptors (f->ssp_descriptors); + f->ssp_descriptors =NULL ; }EXPORT_SYMBOL_GPL (usb_free_all_descriptors);
You may add Fixed-by tag, and cc to stable tree.
Signature · 2 lines
Thanks, Peter Chen