Patch "usb: gadget: f_fs: Fix use-after-free in ffs_free_inst" has been added to the 4.13-stable tree

This is a note to let you know that I've just added the patch titled

usb: gadget: f_fs: Fix use-after-free in ffs_free_inst

to the 4.13-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
usb-gadget-f_fs-fix-use-after-free-in-ffs_free_inst.patch
and it can be found in the queue-4.13 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

From: Andrew Gabbasov <[email protected]>
Date: Wed, 8 Nov 2017 10:13:15 -0700
Subject: usb: gadget: f_fs: Fix use-after-free in ffs_free_inst

From: Andrew Gabbasov <[email protected]>

commit cdafb6d8b8da7fde266f79b3287ac221aa841879 upstream.

KASAN enabled configuration reports an error

BUG: KASAN: use-after-free in ffs_free_inst+... [usb_f_fs] at addr ...
Write of size 8 by task ...

This is observed after "ffs-test" is run and interrupted. If after that functionfs is unmounted and g_ffs module is unloaded, that use-after-free occurs during g_ffs module removal.

Although the report indicates ffs_free_inst() function, the actual use-after-free condition occurs in _ffs_free_dev() function, which is probably inlined into ffs_free_inst().

This happens due to keeping the ffs_data reference in device structure during functionfs unmounting, while ffs_data itself is freed as no longer needed. The fix is to clear that reference in ffs_closed() function, which is a counterpart of ffs_ready(), where the reference is stored.

---
 drivers/usb/gadget/function/f_fs.c |    1 +
 1 file changed, 1 insertion(+)

@@ -3669,6 +3669,7 @@ static void ffs_closed(struct ffs_data *
 		goto done;
 
 	ffs_obj->desc_ready = false;
+	ffs_obj->ffs_data = NULL;
 
 	if (test_and_clear_bit(FFS_FL_CALL_CLOSED_CALLBACK, &ffs->flags) &&
 	    ffs_obj->ffs_closed_callback)

Patches currently in stable-queue which might be from [email protected] are

queue-4.13/usb-gadget-f_fs-fix-use-after-free-in-ffs_free_inst.patch