Re: [PATCH] [PATCH] usb: gadget: composite: Fix double free memory bug

[mgautam]

Hi,

On 2019-03-15 16:37, Chandana Kishori Chiluveru wrote:
configfs_dev_cleanup function can double free os_desc
and buffer when called from different context. For
example, this can be called from composite_unbind() and
when composite_bind() fails.

Shouldn't we instead fix the error path handling of composite_bind
and configfs_composite_bind?

Fix this issue by setting
request and buffer pointer to NULL after kfree.

Signed-off-by: Chandana Kishori Chiluveru <cchil...@codeaurora.org>
---
 drivers/usb/gadget/composite.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/usb/gadget/composite.c 
b/drivers/usb/gadget/composite.c
index b8a1584..992f1e2 100644
--- a/drivers/usb/gadget/composite.c
+++ b/drivers/usb/gadget/composite.c
@@ -2155,14 +2155,18 @@ void composite_dev_cleanup(struct
usb_composite_dev *cdev)
                        usb_ep_dequeue(cdev->gadget->ep0, cdev->os_desc_req);

                kfree(cdev->os_desc_req->buf);
+               cdev->os_desc_req->buf = NULL;
                usb_ep_free_request(cdev->gadget->ep0, cdev->os_desc_req);
+               cdev->os_desc_req = NULL;

Better to move os_desc_cleanup handling to a different function
say - composite_os_desc_req_cleanup (to match 
composite_os_desc_req_prepare())

        }
        if (cdev->req) {
                if (cdev->setup_pending)
                        usb_ep_dequeue(cdev->gadget->ep0, cdev->req);

                kfree(cdev->req->buf);
+               cdev->req->buf = NULL;
                usb_ep_free_request(cdev->gadget->ep0, cdev->req);
+               cdev->req = NULL;
        }
        cdev->next_string_id = 0;
        device_remove_file(&cdev->gadget->dev, &dev_attr_suspended);