usb: dbgp gadget: fix use after free in dbgp_unbind()

After dbgp_bind()-dbgp_unbind() cycle happens, static variable dbgp
contains pointers to already deallocated memory (dbgp.serial and dbgp.req).
If the next dbgp_bind() fails, for example in usb_ep_alloc_request(),
dbgp_bind() calls dbgp_unbind() on failure path,
and dbgp_unbind() frees dbgp.serial that still stores a pointer
to already deallocated memory.

The patch sets pointers to NULL in dbgp_unbind().

Found by Linux Driver Verification project (linuxtesting.org).

Signed-off-by: Alexey Khoroshilov <khoroshilov@ispras.ru>
Signed-off-by: Felipe Balbi <balbi@ti.com>

diff --git a/drivers/usb/gadget/legacy/dbgp.c b/drivers/usb/gadget/legacy/dbgp.c
index 986fc511a2edcdab4afc6a09780d2b1632159f75..225e385a616009747a42b5117769e316c7638fc6 100644 (file)
--- a/drivers/usb/gadget/legacy/dbgp.c
+++ b/drivers/usb/gadget/legacy/dbgp.c
@@ -222,10 +222,12 @@ static void dbgp_unbind(struct usb_gadget *gadget)
 {
 #ifdef CONFIG_USB_G_DBGP_SERIAL
        kfree(dbgp.serial);
+       dbgp.serial = NULL;
 #endif
        if (dbgp.req) {
                kfree(dbgp.req->buf);
                usb_ep_free_request(gadget->ep0, dbgp.req);
+               dbgp.req = NULL;
        }
 
        gadget->ep0->driver_data = NULL;