Skip to content

Commit 7fafcfd

Browse files
Yavuz, Tubagregkh
Yavuz, Tuba
authored andcommitted
USB: gadget: f_midi: fixing a possible double-free in f_midi
It looks like there is a possibility of a double-free vulnerability on an error path of the f_midi_set_alt function in the f_midi driver. If the path is feasible then free_ep_req gets called twice: req->complete = f_midi_complete; err = usb_ep_queue(midi->out_ep, req, GFP_ATOMIC); => ... usb_gadget_giveback_request => f_midi_complete (CALLBACK) (inside f_midi_complete, for various cases of status) free_ep_req(ep, req); // first kfree if (err) { ERROR(midi, "%s: couldn't enqueue request: %d\n", midi->out_ep->name, err); free_ep_req(midi->out_ep, req); // second kfree return err; } The double-free possibility was introduced with commit ad0d1a0 ("usb: gadget: f_midi: fix leak on failed to enqueue out requests"). Found by MOXCAFE tool. Signed-off-by: Tuba Yavuz <tuba@ece.ufl.edu> Fixes: ad0d1a0 ("usb: gadget: f_midi: fix leak on failed to enqueue out requests") Acked-by: Felipe Balbi <felipe.balbi@linux.intel.com> Cc: stable <stable@vger.kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
1 parent 4d8d5a3 commit 7fafcfd

File tree

2 files changed

+4
-1
lines changed

2 files changed

+4
-1
lines changed

Diff for: drivers/usb/gadget/function/f_midi.c

+2-1
Original file line numberDiff line numberDiff line change
@@ -404,7 +404,8 @@ static int f_midi_set_alt(struct usb_function *f, unsigned intf, unsigned alt)
404404
if (err) {
405405
ERROR(midi, "%s: couldn't enqueue request: %d\n",
406406
midi->out_ep->name, err);
407-
free_ep_req(midi->out_ep, req);
407+
if (req->buf != NULL)
408+
free_ep_req(midi->out_ep, req);
408409
return err;
409410
}
410411
}

Diff for: drivers/usb/gadget/u_f.h

+2
Original file line numberDiff line numberDiff line change
@@ -61,7 +61,9 @@ struct usb_request *alloc_ep_req(struct usb_ep *ep, size_t len);
6161
/* Frees a usb_request previously allocated by alloc_ep_req() */
6262
static inline void free_ep_req(struct usb_ep *ep, struct usb_request *req)
6363
{
64+
WARN_ON(req->buf == NULL);
6465
kfree(req->buf);
66+
req->buf = NULL;
6567
usb_ep_free_request(ep, req);
6668
}
6769

0 commit comments

Comments
 (0)