mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-08-21 08:19:28 +00:00
usb: gadget: f_hid: fix f_hidg lifetime vs cdev
The embedded struct cdev does not have its lifetime correctly tied to
the enclosing struct f_hidg, so there is a use-after-free if /dev/hidgN
is held open while the gadget is deleted.
This can readily be replicated with libusbgx's example programs (for
conciseness - operating directly via configfs is equivalent):
gadget-hid
exec 3<> /dev/hidg0
gadget-vid-pid-remove
exec 3<&-
Pull the existing device up in to struct f_hidg and make use of the
cdev_device_{add,del}() helpers. This changes the lifetime of the
device object to match struct f_hidg, but note that it is still added
and deleted at the same time.
Fixes: 71adf11894
("USB: gadget: add HID gadget driver")
Tested-by: Lee Jones <lee@kernel.org>
Reviewed-by: Andrzej Pietrasiewicz <andrzej.p@collabora.com>
Reviewed-by: Lee Jones <lee@kernel.org>
Signed-off-by: John Keeping <john@metanate.com>
Link: https://lore.kernel.org/r/20221122123523.3068034-2-john@metanate.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
parent
49b42475dd
commit
89ff3dfac6
1 changed files with 28 additions and 24 deletions
|
@ -71,7 +71,7 @@ struct f_hidg {
|
||||||
wait_queue_head_t write_queue;
|
wait_queue_head_t write_queue;
|
||||||
struct usb_request *req;
|
struct usb_request *req;
|
||||||
|
|
||||||
int minor;
|
struct device dev;
|
||||||
struct cdev cdev;
|
struct cdev cdev;
|
||||||
struct usb_function func;
|
struct usb_function func;
|
||||||
|
|
||||||
|
@ -84,6 +84,14 @@ static inline struct f_hidg *func_to_hidg(struct usb_function *f)
|
||||||
return container_of(f, struct f_hidg, func);
|
return container_of(f, struct f_hidg, func);
|
||||||
}
|
}
|
||||||
|
|
||||||
|
static void hidg_release(struct device *dev)
|
||||||
|
{
|
||||||
|
struct f_hidg *hidg = container_of(dev, struct f_hidg, dev);
|
||||||
|
|
||||||
|
kfree(hidg->set_report_buf);
|
||||||
|
kfree(hidg);
|
||||||
|
}
|
||||||
|
|
||||||
/*-------------------------------------------------------------------------*/
|
/*-------------------------------------------------------------------------*/
|
||||||
/* Static descriptors */
|
/* Static descriptors */
|
||||||
|
|
||||||
|
@ -904,9 +912,7 @@ static int hidg_bind(struct usb_configuration *c, struct usb_function *f)
|
||||||
struct usb_ep *ep;
|
struct usb_ep *ep;
|
||||||
struct f_hidg *hidg = func_to_hidg(f);
|
struct f_hidg *hidg = func_to_hidg(f);
|
||||||
struct usb_string *us;
|
struct usb_string *us;
|
||||||
struct device *device;
|
|
||||||
int status;
|
int status;
|
||||||
dev_t dev;
|
|
||||||
|
|
||||||
/* maybe allocate device-global string IDs, and patch descriptors */
|
/* maybe allocate device-global string IDs, and patch descriptors */
|
||||||
us = usb_gstrings_attach(c->cdev, ct_func_strings,
|
us = usb_gstrings_attach(c->cdev, ct_func_strings,
|
||||||
|
@ -999,21 +1005,11 @@ static int hidg_bind(struct usb_configuration *c, struct usb_function *f)
|
||||||
|
|
||||||
/* create char device */
|
/* create char device */
|
||||||
cdev_init(&hidg->cdev, &f_hidg_fops);
|
cdev_init(&hidg->cdev, &f_hidg_fops);
|
||||||
dev = MKDEV(major, hidg->minor);
|
status = cdev_device_add(&hidg->cdev, &hidg->dev);
|
||||||
status = cdev_add(&hidg->cdev, dev, 1);
|
|
||||||
if (status)
|
if (status)
|
||||||
goto fail_free_descs;
|
goto fail_free_descs;
|
||||||
|
|
||||||
device = device_create(hidg_class, NULL, dev, NULL,
|
|
||||||
"%s%d", "hidg", hidg->minor);
|
|
||||||
if (IS_ERR(device)) {
|
|
||||||
status = PTR_ERR(device);
|
|
||||||
goto del;
|
|
||||||
}
|
|
||||||
|
|
||||||
return 0;
|
return 0;
|
||||||
del:
|
|
||||||
cdev_del(&hidg->cdev);
|
|
||||||
fail_free_descs:
|
fail_free_descs:
|
||||||
usb_free_all_descriptors(f);
|
usb_free_all_descriptors(f);
|
||||||
fail:
|
fail:
|
||||||
|
@ -1244,9 +1240,7 @@ static void hidg_free(struct usb_function *f)
|
||||||
|
|
||||||
hidg = func_to_hidg(f);
|
hidg = func_to_hidg(f);
|
||||||
opts = container_of(f->fi, struct f_hid_opts, func_inst);
|
opts = container_of(f->fi, struct f_hid_opts, func_inst);
|
||||||
kfree(hidg->report_desc);
|
put_device(&hidg->dev);
|
||||||
kfree(hidg->set_report_buf);
|
|
||||||
kfree(hidg);
|
|
||||||
mutex_lock(&opts->lock);
|
mutex_lock(&opts->lock);
|
||||||
--opts->refcnt;
|
--opts->refcnt;
|
||||||
mutex_unlock(&opts->lock);
|
mutex_unlock(&opts->lock);
|
||||||
|
@ -1256,8 +1250,7 @@ static void hidg_unbind(struct usb_configuration *c, struct usb_function *f)
|
||||||
{
|
{
|
||||||
struct f_hidg *hidg = func_to_hidg(f);
|
struct f_hidg *hidg = func_to_hidg(f);
|
||||||
|
|
||||||
device_destroy(hidg_class, MKDEV(major, hidg->minor));
|
cdev_device_del(&hidg->cdev, &hidg->dev);
|
||||||
cdev_del(&hidg->cdev);
|
|
||||||
|
|
||||||
usb_free_all_descriptors(f);
|
usb_free_all_descriptors(f);
|
||||||
}
|
}
|
||||||
|
@ -1266,6 +1259,7 @@ static struct usb_function *hidg_alloc(struct usb_function_instance *fi)
|
||||||
{
|
{
|
||||||
struct f_hidg *hidg;
|
struct f_hidg *hidg;
|
||||||
struct f_hid_opts *opts;
|
struct f_hid_opts *opts;
|
||||||
|
int ret;
|
||||||
|
|
||||||
/* allocate and initialize one new instance */
|
/* allocate and initialize one new instance */
|
||||||
hidg = kzalloc(sizeof(*hidg), GFP_KERNEL);
|
hidg = kzalloc(sizeof(*hidg), GFP_KERNEL);
|
||||||
|
@ -1277,17 +1271,27 @@ static struct usb_function *hidg_alloc(struct usb_function_instance *fi)
|
||||||
mutex_lock(&opts->lock);
|
mutex_lock(&opts->lock);
|
||||||
++opts->refcnt;
|
++opts->refcnt;
|
||||||
|
|
||||||
hidg->minor = opts->minor;
|
device_initialize(&hidg->dev);
|
||||||
|
hidg->dev.release = hidg_release;
|
||||||
|
hidg->dev.class = hidg_class;
|
||||||
|
hidg->dev.devt = MKDEV(major, opts->minor);
|
||||||
|
ret = dev_set_name(&hidg->dev, "hidg%d", opts->minor);
|
||||||
|
if (ret) {
|
||||||
|
--opts->refcnt;
|
||||||
|
mutex_unlock(&opts->lock);
|
||||||
|
return ERR_PTR(ret);
|
||||||
|
}
|
||||||
|
|
||||||
hidg->bInterfaceSubClass = opts->subclass;
|
hidg->bInterfaceSubClass = opts->subclass;
|
||||||
hidg->bInterfaceProtocol = opts->protocol;
|
hidg->bInterfaceProtocol = opts->protocol;
|
||||||
hidg->report_length = opts->report_length;
|
hidg->report_length = opts->report_length;
|
||||||
hidg->report_desc_length = opts->report_desc_length;
|
hidg->report_desc_length = opts->report_desc_length;
|
||||||
if (opts->report_desc) {
|
if (opts->report_desc) {
|
||||||
hidg->report_desc = kmemdup(opts->report_desc,
|
hidg->report_desc = devm_kmemdup(&hidg->dev, opts->report_desc,
|
||||||
opts->report_desc_length,
|
opts->report_desc_length,
|
||||||
GFP_KERNEL);
|
GFP_KERNEL);
|
||||||
if (!hidg->report_desc) {
|
if (!hidg->report_desc) {
|
||||||
kfree(hidg);
|
put_device(&hidg->dev);
|
||||||
mutex_unlock(&opts->lock);
|
mutex_unlock(&opts->lock);
|
||||||
return ERR_PTR(-ENOMEM);
|
return ERR_PTR(-ENOMEM);
|
||||||
}
|
}
|
||||||
|
|
Loading…
Reference in a new issue