From patchwork Thu Dec 3 15:32:04 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Andy Shevchenko X-Patchwork-Id: 1410473 X-Patchwork-Delegate: lukma@denx.de Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=lists.denx.de (client-ip=2a01:238:438b:c500:173d:9f52:ddab:ee01; helo=phobos.denx.de; envelope-from=u-boot-bounces@lists.denx.de; receiver=) Authentication-Results: ozlabs.org; dmarc=fail (p=none dis=none) header.from=linux.intel.com Received: from phobos.denx.de (phobos.denx.de [IPv6:2a01:238:438b:c500:173d:9f52:ddab:ee01]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 4Cn0G04pryz9sPB for ; Fri, 4 Dec 2020 02:32:40 +1100 (AEDT) Received: from h2850616.stratoserver.net (localhost [IPv6:::1]) by phobos.denx.de (Postfix) with ESMTP id DCFE182703; Thu, 3 Dec 2020 16:32:16 +0100 (CET) Authentication-Results: phobos.denx.de; dmarc=none (p=none dis=none) header.from=linux.intel.com Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=u-boot-bounces@lists.denx.de Received: by phobos.denx.de (Postfix, from userid 109) id B2BC4826EE; Thu, 3 Dec 2020 16:32:14 +0100 (CET) X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on phobos.denx.de X-Spam-Level: X-Spam-Status: No, score=-4.2 required=5.0 tests=BAYES_00,RCVD_IN_DNSWL_MED, RCVD_IN_MSPIKE_H4,RCVD_IN_MSPIKE_WL,SPF_HELO_NONE autolearn=ham autolearn_force=no version=3.4.2 Received: from mga06.intel.com (mga06.intel.com [134.134.136.31]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by phobos.denx.de (Postfix) with ESMTPS id 1353D826EB for ; Thu, 3 Dec 2020 16:32:11 +0100 (CET) Authentication-Results: phobos.denx.de; dmarc=none (p=none dis=none) header.from=linux.intel.com Authentication-Results: phobos.denx.de; spf=none smtp.mailfrom=andriy.shevchenko@linux.intel.com IronPort-SDR: nIR6Z1RDgWS36fp0MCt+AEbp2ksRTSkn6kySJ5ZUYpAJa2f8o6yUm40btvG3FNvO34v+HtB07M bWgM97p3sO+w== X-IronPort-AV: E=McAfee;i="6000,8403,9824"; a="234815282" X-IronPort-AV: E=Sophos;i="5.78,389,1599548400"; d="scan'208";a="234815282" X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from orsmga005.jf.intel.com ([10.7.209.41]) by orsmga104.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 03 Dec 2020 07:32:10 -0800 IronPort-SDR: BB/fIM99HzDukjvE+L8DZOqo7nTpgNTzfEXQ4T5JNZuK1/jjK73p64ncCn3Ielvw+SrBLcW7yX 4A2jBuw1uLpw== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.78,389,1599548400"; d="scan'208";a="550525596" Received: from black.fi.intel.com ([10.237.72.28]) by orsmga005.jf.intel.com with ESMTP; 03 Dec 2020 07:32:08 -0800 Received: by black.fi.intel.com (Postfix, from userid 1003) id 33908109; Thu, 3 Dec 2020 17:32:07 +0200 (EET) From: Andy Shevchenko To: Lukasz Majewski , Marek Vasut , u-boot@lists.denx.de, Eddie Cai Cc: Andy Shevchenko Subject: [PATCH v1 2/3] f_rockusb: Avoid use-after-free in the global pointer variable Date: Thu, 3 Dec 2020 17:32:04 +0200 Message-Id: <20201203153205.22966-2-andriy.shevchenko@linux.intel.com> X-Mailer: git-send-email 2.29.2 In-Reply-To: <20201203153205.22966-1-andriy.shevchenko@linux.intel.com> References: <20201203153205.22966-1-andriy.shevchenko@linux.intel.com> MIME-Version: 1.0 X-BeenThere: u-boot@lists.denx.de X-Mailman-Version: 2.1.34 Precedence: list List-Id: U-Boot discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: u-boot-bounces@lists.denx.de Sender: "U-Boot" X-Virus-Scanned: clamav-milter 0.102.3 at phobos.denx.de X-Virus-Status: Clean In case of usb_add_function() failure the error path has two issues: - the potentially allocated structure isn't getting freed - the global pointer variable is assigned to garbage Fix the above mentioned issues by freeing memory and assigning NULL. Signed-off-by: Andy Shevchenko --- drivers/usb/gadget/f_rockusb.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/usb/gadget/f_rockusb.c b/drivers/usb/gadget/f_rockusb.c index 9dd10f9e9aa1..bd846ce9a77b 100644 --- a/drivers/usb/gadget/f_rockusb.c +++ b/drivers/usb/gadget/f_rockusb.c @@ -309,8 +309,9 @@ static int rockusb_add(struct usb_configuration *c) status = usb_add_function(c, &f_rkusb->usb_function); if (status) { + free(f_rkusb->buf_head); free(f_rkusb); - rockusb_func = f_rkusb; + rockusb_func = NULL; } return status; }