Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1347911 > unrolled thread
| Started by | Dan Carpenter <dan.carpenter@oracle.com> |
|---|---|
| First post | 2016-03-02 11:10 +0100 |
| Last post | 2016-03-02 13:00 +0100 |
| Articles | 2 — 2 participants |
Back to article view | Back to linux.kernel
[patch -target tree] usb: gadget: f_tcm: use after free Dan Carpenter <dan.carpenter@oracle.com> - 2016-03-02 11:10 +0100
Re: [patch -target tree] usb: gadget: f_tcm: use after free Felipe Balbi <balbi@kernel.org> - 2016-03-02 13:00 +0100
| From | Dan Carpenter <dan.carpenter@oracle.com> |
|---|---|
| Date | 2016-03-02 11:10 +0100 |
| Subject | [patch -target tree] usb: gadget: f_tcm: use after free |
| Message-ID | <r8bTd-6bA-11@gated-at.bofh.it> |
We need to move the kfree() down a line so we don't dereference a freed
variable.
Fixes: 1b418a8fcbc0 ('target: Convert demo-mode only drivers to target_alloc_session')
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
diff --git a/drivers/usb/gadget/function/f_tcm.c b/drivers/usb/gadget/function/f_tcm.c
index 7276a73..e352a31 100644
--- a/drivers/usb/gadget/function/f_tcm.c
+++ b/drivers/usb/gadget/function/f_tcm.c
@@ -1596,8 +1596,8 @@ static int tcm_usbg_make_nexus(struct usbg_tpg *tpg, char *name)
#define MAKE_NEXUS_MSG "core_tpg_check_initiator_node_acl() failed for %s\n"
pr_debug(MAKE_NEXUS_MSG, name);
#undef MAKE_NEXUS_MSG
- kfree(tv_nexus);
ret = PTR_ERR(tv_nexus->tvn_se_sess);
+ kfree(tv_nexus);
}
out_unlock:
[toc] | [next] | [standalone]
| From | Felipe Balbi <balbi@kernel.org> |
|---|---|
| Date | 2016-03-02 13:00 +0100 |
| Message-ID | <r8dBD-75k-9@gated-at.bofh.it> |
| In reply to | #1347911 |
[Multipart message — attachments visible in raw view] — view raw
Dan Carpenter <dan.carpenter@oracle.com> writes:
> We need to move the kfree() down a line so we don't dereference a freed
> variable.
>
> Fixes: 1b418a8fcbc0 ('target: Convert demo-mode only drivers to target_alloc_session')
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
It's okay to take this via target:
Signed-off-by: Felipe Balbi <balbi@kernel.org>
> diff --git a/drivers/usb/gadget/function/f_tcm.c b/drivers/usb/gadget/function/f_tcm.c
> index 7276a73..e352a31 100644
> --- a/drivers/usb/gadget/function/f_tcm.c
> +++ b/drivers/usb/gadget/function/f_tcm.c
> @@ -1596,8 +1596,8 @@ static int tcm_usbg_make_nexus(struct usbg_tpg *tpg, char *name)
> #define MAKE_NEXUS_MSG "core_tpg_check_initiator_node_acl() failed for %s\n"
> pr_debug(MAKE_NEXUS_MSG, name);
> #undef MAKE_NEXUS_MSG
> - kfree(tv_nexus);
> ret = PTR_ERR(tv_nexus->tvn_se_sess);
> + kfree(tv_nexus);
> }
>
> out_unlock:
--
balbi
[toc] | [prev] | [standalone]
Back to top | Article view | linux.kernel
csiph-web