linux-kernel - RE: [PATCH] usb: gadget: acm: set notify_req to NULL after freed to avoid double free

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <0C18FE92A7765D4EB9EE5D38D86A563A0316D9B8@SHSMSX103.ccr.corp.intel.com>
Date:	Mon, 28 Dec 2015 06:06:13 +0000
From:	"Du, Changbin" <changbin.du@...el.com>
To:	Robert Baldyga <r.baldyga@...kerion.com>,
	"balbi@...com" <balbi@...com>,
	"gregkh@...uxfoundation.org" <gregkh@...uxfoundation.org>
CC:	"r.baldyga@...sung.com" <r.baldyga@...sung.com>,
	"nab@...ux-iscsi.org" <nab@...ux-iscsi.org>,
	"andrzej.p@...sung.com" <andrzej.p@...sung.com>,
	"linux-usb@...r.kernel.org" <linux-usb@...r.kernel.org>,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: RE: [PATCH] usb: gadget: acm: set notify_req to NULL after freed to
 avoid double free

> On 12/26/2015 04:57 AM, changbin.du@...el.com wrote:
> > From: "Du, Changbin" <changbin.du@...el.com>
> >
> > If acm_bind fails before allocate notification and acm->notify_req is
> > not set to NULL after freed last time, double free will happen.
> 
> Looks good to me.
> 
> Similar problem can occur with another USB functions (at least f_ecm,
> f_ncm, f_rndis and f_hid handle USB requests in analogical way). Maybe
> it's worth to fix them all at once?
> 
> >
> > kernel BUG at mm/slub.c:3392!
> > invalid opcode: 0000 [#1] PREEMPT SMP
> > EIP is at kfree+0x172/0x180
> > Call Trace:
> > [<80c0e3b6>] ? usb_ep_autoconfig_ss+0x86/0x170
> > [<80c13345>] gs_free_req+0x15/0x30
> > [<80c12df1>] acm_bind+0x1c1/0x2d0
> > [<80c0e9be>] usb_add_function+0x6e/0x120
> > [<80c213cb>] acm_function_bind_config+0x2b/0x90
> >
> 
> Reviewed-by: Robert Baldyga <r.baldyga@...kerion.com>
>
Hmm, you are right. I checked all the fucntions, found these need to be fixed:
f_ecm.c f_hid.c f_ncm.c f_phonet.c f_rndis.c f_uvc.c

I will update patche to fix them all. thank you.

Regards,
Du, Changbin