lkml.org 
[lkml]   [2022]   [Aug]   [14]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH AUTOSEL 5.18 05/56] usb: cdns3 fix use-after-free at workaround 2
    Date
    From: Frank Li <Frank.Li@nxp.com>

    [ Upstream commit 7d602f30149a117eea260208b1661bc404c21dfd ]

    BUG: KFENCE: use-after-free read in __list_del_entry_valid+0x10/0xac

    cdns3_wa2_remove_old_request()
    {
    ...
    kfree(priv_req->request.buf);
    cdns3_gadget_ep_free_request(&priv_ep->endpoint, &priv_req->request);
    list_del_init(&priv_req->list);
    ^^^ use after free
    ...
    }

    cdns3_gadget_ep_free_request() free the space pointed by priv_req,
    but priv_req is used in the following list_del_init().

    This patch move list_del_init() before cdns3_gadget_ep_free_request().

    Signed-off-by: Frank Li <Frank.Li@nxp.com>
    Signed-off-by: Faqiang Zhu <faqiang.zhu@nxp.com>
    Link: https://lore.kernel.org/r/20220608190430.2814358-1-Frank.Li@nxp.com
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/usb/cdns3/cdns3-gadget.c | 2 +-
    1 file changed, 1 insertion(+), 1 deletion(-)

    diff --git a/drivers/usb/cdns3/cdns3-gadget.c b/drivers/usb/cdns3/cdns3-gadget.c
    index d6d515d598dc..c4f90b124e55 100644
    --- a/drivers/usb/cdns3/cdns3-gadget.c
    +++ b/drivers/usb/cdns3/cdns3-gadget.c
    @@ -625,9 +625,9 @@ static void cdns3_wa2_remove_old_request(struct cdns3_endpoint *priv_ep)
    trace_cdns3_wa2(priv_ep, "removes eldest request");

    kfree(priv_req->request.buf);
    + list_del_init(&priv_req->list);
    cdns3_gadget_ep_free_request(&priv_ep->endpoint,
    &priv_req->request);
    - list_del_init(&priv_req->list);
    --priv_ep->wa2_counter;

    if (!chain)
    --
    2.35.1
    \
     
     \ /
      Last update: 2022-08-14 17:37    [W:2.575 / U:0.000 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site