• Andrew Gabbasov's avatar
    usb: gadget: composite: Fix use-after-free in usb_composite_overwrite_options · aec17e1e
    Andrew Gabbasov authored
    KASAN enabled configuration reports an error
    
        BUG: KASAN: use-after-free in usb_composite_overwrite_options+...
                    [libcomposite] at addr ...
        Read of size 1 by task ...
    
    when some driver is un-bound and then bound again.
    For example, this happens with FunctionFS driver when "ffs-test"
    test application is run several times in a row.
    
    If the driver has empty manufacturer ID string in initial static data,
    it is then replaced with generated string. After driver unbinding
    the generated string is freed, but the driver data still keep that
    pointer. And if the driver is then bound again, that pointer
    is re-used for string emptiness check.
    
    The fix is to clean up the driver string data upon its unbinding
    to drop the pointer to freed memory.
    
    Fixes: cc2683c3 ("usb: gadget: Provide a default implementation of default manufacturer string")
    Cc: stable@vger.kernel.org
    Signed-off-by: default avatarAndrew Gabbasov <andrew_gabbasov@mentor.com>
    Signed-off-by: default avatarFelipe Balbi <felipe.balbi@linux.intel.com>
    aec17e1e
composite.c 64.1 KB