Re: [PATCH v2] usb: gadget: configfs: Fix KASAN use-after-free

2017-09-01 Thread Kees Cook
On Tue, Jan 17, 2017 at 1:29 AM, Jim Lin wrote: > When gadget is disconnected, running sequence is like this. > . composite_disconnect > . Call trace: > usb_string_copy+0xd0/0x128 > gadget_config_name_configuration_store+0x4 > gadget_config_name_attr_store+0x40/0x50 > configfs_write_file+0

[PATCH v2] usb: gadget: configfs: Fix KASAN use-after-free

2017-01-17 Thread Jim Lin
When gadget is disconnected, running sequence is like this. . composite_disconnect . Call trace: usb_string_copy+0xd0/0x128 gadget_config_name_configuration_store+0x4 gadget_config_name_attr_store+0x40/0x50 configfs_write_file+0x198/0x1f4 vfs_write+0x100/0x220 SyS_write+0x58/0xa8 . conf