diff options
| author | Heinrich Schuchardt | 2016-05-08 22:50:12 +0200 |
|---|---|---|
| committer | Felipe Balbi | 2016-05-31 10:24:30 +0200 |
| commit | e877b729c649c2850f61f2ae37296ae701f9ad63 (patch) | |
| tree | 428e47fa38118e7af581ff0a3e36e7f35351a5cf /drivers/usb | |
| parent | usb: gadget: avoid exposing kernel stack (diff) | |
| download | kernel-qcow2-linux-e877b729c649c2850f61f2ae37296ae701f9ad63.tar.gz kernel-qcow2-linux-e877b729c649c2850f61f2ae37296ae701f9ad63.tar.xz kernel-qcow2-linux-e877b729c649c2850f61f2ae37296ae701f9ad63.zip | |
usb: gadget: f_tcm: out of bound access in usbg_drop_tpg
Commit dc8c46a5ae77 ("usb: gadget: f_tcm: convert to new function
interface with backward compatibility") introduced a possible out
of bounds memory access:
If tpg is not found in function usbg_drop_tpg,
tpg_instances[TPG_INSTANCES] is accessed.
Fixes: dc8c46a5ae77 ("usb: gadget: f_tcm: convert to new function interface with backward compatibility")
Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
Diffstat (limited to 'drivers/usb')
| -rw-r--r-- | drivers/usb/gadget/function/f_tcm.c | 20 |
1 files changed, 11 insertions, 9 deletions
diff --git a/drivers/usb/gadget/function/f_tcm.c b/drivers/usb/gadget/function/f_tcm.c index 35fe3c80cfc0..197f73386fac 100644 --- a/drivers/usb/gadget/function/f_tcm.c +++ b/drivers/usb/gadget/function/f_tcm.c @@ -1445,16 +1445,18 @@ static void usbg_drop_tpg(struct se_portal_group *se_tpg) for (i = 0; i < TPG_INSTANCES; ++i) if (tpg_instances[i].tpg == tpg) break; - if (i < TPG_INSTANCES) + if (i < TPG_INSTANCES) { tpg_instances[i].tpg = NULL; - opts = container_of(tpg_instances[i].func_inst, - struct f_tcm_opts, func_inst); - mutex_lock(&opts->dep_lock); - if (opts->has_dep) - module_put(opts->dependent); - else - configfs_undepend_item_unlocked(&opts->func_inst.group.cg_item); - mutex_unlock(&opts->dep_lock); + opts = container_of(tpg_instances[i].func_inst, + struct f_tcm_opts, func_inst); + mutex_lock(&opts->dep_lock); + if (opts->has_dep) + module_put(opts->dependent); + else + configfs_undepend_item_unlocked( + &opts->func_inst.group.cg_item); + mutex_unlock(&opts->dep_lock); + } mutex_unlock(&tpg_instances_lock); kfree(tpg); |