linux-kernel - [patch -target tree] usb: gadget: f

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:	Wed, 2 Mar 2016 13:08:48 +0300
From:	Dan Carpenter <dan.carpenter@...cle.com>
To:	Felipe Balbi <balbi@...nel.org>, Christoph Hellwig <hch@....de>,
	Nicholas Bellinger <nab@...ux-iscsi.org>
Cc:	Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
	Sebastian Andrzej Siewior <bigeasy@...utronix.de>,
	Andrzej Pietrasiewicz <andrzej.p@...sung.com>,
	Bart Van Assche <bart.vanassche@...disk.com>,
	linux-usb@...r.kernel.org, linux-kernel@...r.kernel.org,
	target-devel@...r.kernel.org
Subject: [patch -target tree] usb: gadget: f_tcm: use after free

We need to move the kfree() down a line so we don't dereference a freed
variable.

Fixes: 1b418a8fcbc0 ('target: Convert demo-mode only drivers to target_alloc_session')
Signed-off-by: Dan Carpenter <dan.carpenter@...cle.com>

diff --git a/drivers/usb/gadget/function/f_tcm.c b/drivers/usb/gadget/function/f_tcm.c
index 7276a73..e352a31 100644
--- a/drivers/usb/gadget/function/f_tcm.c
+++ b/drivers/usb/gadget/function/f_tcm.c
@@ -1596,8 +1596,8 @@ static int tcm_usbg_make_nexus(struct usbg_tpg *tpg, char *name)
 #define MAKE_NEXUS_MSG "core_tpg_check_initiator_node_acl() failed for %s\n"
 		pr_debug(MAKE_NEXUS_MSG, name);
 #undef MAKE_NEXUS_MSG
-		kfree(tv_nexus);
 		ret = PTR_ERR(tv_nexus->tvn_se_sess);
+		kfree(tv_nexus);
 	}
 
 out_unlock: