Skip to content

Commit

Permalink
usb: gadget: f_fs: Stop ffs_closed NULL pointer dereference
Browse files Browse the repository at this point in the history
The struct ffs_data::private_data has a pointer to
ffs_dev stored in it during the ffs_fs_mount() function
however it is not cleared when the ffs_dev is freed
later which causes the ffs_closed function to crash
with "Unable to handle kernel NULL pointer dereference"
error when using the data in ffs_data::private_data.

This clears this pointer during the ffs_free_dev clean
up function.

Signed-off-by: Jim Baxter <[email protected]>
Signed-off-by: Jiada Wang <[email protected]>
Signed-off-by: Harish Jenny K N <[email protected]>
Signed-off-by: Felipe Balbi <[email protected]>
  • Loading branch information
Jim Baxter authored and Felipe Balbi committed Sep 8, 2016
1 parent 9d6173e commit 3262ad8
Showing 1 changed file with 5 additions and 0 deletions.
5 changes: 5 additions & 0 deletions drivers/usb/gadget/function/f_fs.c
Original file line number Diff line number Diff line change
Expand Up @@ -3502,6 +3502,11 @@ static void _ffs_free_dev(struct ffs_dev *dev)
list_del(&dev->entry);
if (dev->name_allocated)
kfree(dev->name);

/* Clear the private_data pointer to stop incorrect dev access */
if (dev->ffs_data)
dev->ffs_data->private_data = NULL;

kfree(dev);
if (list_empty(&ffs_devices))
functionfs_cleanup();
Expand Down

0 comments on commit 3262ad8

Please sign in to comment.