Messages in this thread |  | | Subject | Re: [PATCH] udc: Memory leak on error path and use after free | From | Anton Vasilyev <> | Date | Wed, 16 Aug 2017 19:00:05 +0300 |
| |
On 16.08.2017 18:29, Alan Stern wrote: > On Wed, 16 Aug 2017, Anton Vasilyev wrote: > >> gadget_release() is responsible for cleanup dev memory. >> But if net2280_probe() fails after dev allocation, then >> gadget_release() become unregistered and dev memory leaks. > > This isn't needed if usb_add_gadget_udc_release() is fixed, right? >
No, this situation could appear before call usb_add_gadget_udc_release().
>> Also net2280_remove() calls usb_del_gadget_udc() which >> perform schedule_delayed_work() with gadget_release(), so >> it is possible that dev will be deallocated exactly after >> this call and leads to use after free. > > Where is there a possible use after free? >
net2280_remove() continue work with struct net2280 *dev after call usb_del_gadget_udc(&dev->gadget), but this net2280 *dev could be deallocated by gadget_release()
>> The patch moves deallocation from gadget_release() to >> net2280_remove(). > > Alan Stern >
-- Anton Vasilyev Linux Verification Center, ISPRAS web: http://linuxtesting.org e-mail: vasilyev@ispras.ru
|  |