[RESEND PATCH v2] usb: gadget: configfs: Fix use-after-free issue with udc_name

2020-10-31 Thread Macpaul Lin
From: Eddie Hung There is a use-after-free issue, if access udc_name in function gadget_dev_desc_UDC_store after another context free udc_name in function unregister_gadget. Context 1: gadget_dev_desc_UDC_store()->unregister_gadget()-> free udc_name->set udc_name to NULL Context 2: gadget_dev_d

Re: [PATCH v2] usb: gadget: configfs: Fix use-after-free issue with udc_name

2020-10-28 Thread Macpaul Lin
On Thu, 2020-10-29 at 01:55 +0800, Macpaul Lin wrote: > From: Eddie Hung > > There is a use-after-free issue, if access udc_name > in function gadget_dev_desc_UDC_store after another context > free udc_name in function unregister_gadget. > > Context 1: > gadget_dev_desc_UDC_store()->unregister_g

[PATCH v2] usb: gadget: configfs: Fix use-after-free issue with udc_name

2020-10-28 Thread Macpaul Lin
From: Eddie Hung There is a use-after-free issue, if access udc_name in function gadget_dev_desc_UDC_store after another context free udc_name in function unregister_gadget. Context 1: gadget_dev_desc_UDC_store()->unregister_gadget()-> free udc_name->set udc_name to NULL Context 2: gadget_dev_d

Re: [PATCH v2] usb: gadget: configfs: Fix use-after-free issue with udc_name

2020-10-27 Thread Felipe Balbi
Hi, Macpaul Lin writes: > From: Eddie Hung > > There is a use-after-free issue, if access udc_name > in function gadget_dev_desc_UDC_store after another context > free udc_name in function unregister_gadget. > > Context 1: > gadget_dev_desc_UDC_store()->unregister_gadget()-> > free udc_name->se

Re: [PATCH v2] usb: gadget: configfs: Fix use-after-free issue with udc_name

2020-10-19 Thread Macpaul Lin
On Sat, 2020-07-18 at 10:45 +0800, Macpaul Lin wrote: > From: Eddie Hung > There is a use-after-free issue, if access udc_name > in function gadget_dev_desc_UDC_store after another context > free udc_name in function unregister_gadget. > > Context 1: > gadget_dev_desc_UDC_store()->unregister_gadg

Re: [PATCH v2] usb: gadget: configfs: Fix use-after-free issue with udc_name

2020-07-21 Thread Macpaul Lin
On Tue, 2020-07-21 at 13:33 +0200, Greg Kroah-Hartman wrote: > On Sat, Jul 18, 2020 at 10:58:53AM +0800, Macpaul Lin wrote: > > On Sat, 2020-07-18 at 10:45 +0800, Macpaul Lin wrote: > > > From: Eddie Hung > > > > > > > Well, it's strange, I simply replaced the uploader's name to my > > colleague

Re: [PATCH v2] usb: gadget: configfs: Fix use-after-free issue with udc_name

2020-07-21 Thread Greg Kroah-Hartman
On Sat, Jul 18, 2020 at 10:58:53AM +0800, Macpaul Lin wrote: > On Sat, 2020-07-18 at 10:45 +0800, Macpaul Lin wrote: > > From: Eddie Hung > > > > Well, it's strange, I simply replaced the uploader's name to my > colleague, git send-email pop up this line automatically. > > Shouldn't I do that k

Re: [PATCH v2] usb: gadget: configfs: Fix use-after-free issue with udc_name

2020-07-17 Thread Macpaul Lin
On Sat, 2020-07-18 at 10:45 +0800, Macpaul Lin wrote: > From: Eddie Hung > Well, it's strange, I simply replaced the uploader's name to my colleague, git send-email pop up this line automatically. Shouldn't I do that kind of change. It did not happened before. Do I need to change it back and up

[PATCH v2] usb: gadget: configfs: Fix use-after-free issue with udc_name

2020-07-17 Thread Macpaul Lin
From: Eddie Hung There is a use-after-free issue, if access udc_name in function gadget_dev_desc_UDC_store after another context free udc_name in function unregister_gadget. Context 1: gadget_dev_desc_UDC_store()->unregister_gadget()-> free udc_name->set udc_name to NULL Context 2: gadget_dev_d