linux-kernel - [PATCH] USB: Gadget: Composite: Added error handling codes to prevent a memory leak case when the configuration's bind function failed

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:	Tue, 20 Mar 2012 10:38:38 +0900
From:	Yongsul Oh <yongsul96.oh@...sung.com>
To:	Felipe Balbi <balbi@...com>,
	Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Cc:	Michal Nazarewicz <mnazarewicz@...il.com>,
	Sergei Shtylyov <sshtylyov@...sta.com>,
	linux-usb@...r.kernel.org, linux-kernel@...r.kernel.org,
	Yongsul Oh <yongsul96.oh@...sung.com>
Subject: [PATCH] USB: Gadget: Composite: Added error handling codes to prevent
 a memory leak case when the configuration's bind function failed

 In some USB composite gadget drivers, the configuration's bind function
  called by the usb_add_config() calls multiple bind config functions.
  (for example cdc2 configuration bind function in the cdc_do_config()
  of the cdc2.c has two functionality bind config functions.
  - the ecm_bind_config() & the acm_bind_config())

 In each functionality bind config function, new instance is allocated and
  finally added by the usb_add_function().

 So if an error occurred during the second functionality bind config
  (for example an error occurred at the acm_bind_config() after succeeding of
  the ecm_bind_function()), the instance created by the acm_bind_config()
  cannot be freed creating a memory leak.

 This patch fixes this issue.

Signed-off-by: Yongsul Oh <yongsul96.oh@...sung.com>
---
 drivers/usb/gadget/composite.c |   13 +++++++++++++
 1 files changed, 13 insertions(+), 0 deletions(-)

diff --git a/drivers/usb/gadget/composite.c b/drivers/usb/gadget/composite.c
index baaebf2..4cb1801 100644
--- a/drivers/usb/gadget/composite.c
+++ b/drivers/usb/gadget/composite.c
@@ -737,6 +737,19 @@ int usb_add_config(struct usb_composite_dev *cdev,
 
 	status = bind(config);
 	if (status < 0) {
+		while (!list_empty(&config->functions)) {
+			struct usb_function		*f;
+
+			f = list_first_entry(&config->functions,
+					struct usb_function, list);
+			list_del(&f->list);
+			if (f->unbind) {
+				DBG(cdev, "unbind function '%s'/%p\n",
+					f->name, f);
+				f->unbind(config, f);
+				/* may free memory for "f" */
+			}
+		}
 		list_del(&config->list);
 		config->cdev = NULL;
 	} else {
-- 
1.7.1

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/