From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S965348AbcIHJSh (ORCPT ); Thu, 8 Sep 2016 05:18:37 -0400 Received: from relay1.mentorg.com ([192.94.38.131]:32781 "EHLO relay1.mentorg.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S937116AbcIHJSe (ORCPT ); Thu, 8 Sep 2016 05:18:34 -0400 From: Harish Jenny K N To: Felipe Balbi CC: , Greg Kroah-Hartman , , Jim Baxter Subject: [PATCH v1 1/1] usb: gadget: f_fs: Stop ffs_closed NULL pointers. Date: Thu, 8 Sep 2016 11:18:16 +0200 Message-ID: <1473326296-23987-2-git-send-email-harish_kandiga@mentor.com> X-Mailer: git-send-email 1.7.9.5 In-Reply-To: <1473326296-23987-1-git-send-email-harish_kandiga@mentor.com> References: <1473326296-23987-1-git-send-email-harish_kandiga@mentor.com> MIME-Version: 1.0 Content-Type: text/plain Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Jim Baxter The struct ffs_data::private_data has a pointer to ffs_dev stored in it during the ffs_fs_mount() function however it is not cleared when the ffs_dev is freed later which causes the ffs_closed function to crash with "Unable to handle kernel NULL pointer dereference" error when using the data in ffs_data::private_data. This clears this pointer during the ffs_free_dev clean up function. Signed-off-by: Jim Baxter Signed-off-by: Jiada Wang Signed-off-by: Harish Jenny K N --- drivers/usb/gadget/function/f_fs.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c index 5c8429f..b309650 100644 --- a/drivers/usb/gadget/function/f_fs.c +++ b/drivers/usb/gadget/function/f_fs.c @@ -3470,6 +3470,11 @@ static void _ffs_free_dev(struct ffs_dev *dev) list_del(&dev->entry); if (dev->name_allocated) kfree(dev->name); + + /* Clear the private_data pointer to stop incorrect dev access */ + if (dev->ffs_data) + dev->ffs_data->private_data = NULL; + kfree(dev); if (list_empty(&ffs_devices)) functionfs_cleanup(); -- 1.7.9.5