usb: gadget: f_fs: Stop ffs_closed NULL pointer dereference

The struct ffs_data::private_data has a pointer to ffs_dev stored in it during the ffs_fs_mount() function however it is not cleared when the ffs_dev is freed later which causes the ffs_closed function to crash with "Unable to handle kernel NULL pointer dereference" error when using the data in ffs_data::private_data. This clears this pointer during the ffs_free_dev clean up function. Signed-off-by: Jim Baxter <[email protected]> Signed-off-by: Jiada Wang <[email protected]> Signed-off-by: Harish Jenny K N <[email protected]> Signed-off-by: Felipe Balbi <[email protected]>
delphix · Sep 8, 2016 · 3262ad8 · 3262ad8
1 parent 9d6173e
commit 3262ad8
Showing 1 changed file with 5 additions and 0 deletions.
diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c
@@ -3502,6 +3502,11 @@ static void _ffs_free_dev(struct ffs_dev *dev)
 	list_del(&dev->entry);
 	if (dev->name_allocated)
 		kfree(dev->name);
+
+	/* Clear the private_data pointer to stop incorrect dev access */
+	if (dev->ffs_data)
+		dev->ffs_data->private_data = NULL;
+
 	kfree(dev);
 	if (list_empty(&ffs_devices))
 		functionfs_cleanup();