From 67bb2799fb7e2b0bb0516da51c546f760e229ec0 Mon Sep 17 00:00:00 2001 From: Jim Baxter Date: Thu, 8 Sep 2016 11:18:16 +0200 Subject: [PATCH] UPSTREAM: usb: gadget: f_fs: Stop ffs_closed NULL pointer dereference The struct ffs_data::private_data has a pointer to ffs_dev stored in it during the ffs_fs_mount() function however it is not cleared when the ffs_dev is freed later which causes the ffs_closed function to crash with "Unable to handle kernel NULL pointer dereference" error when using the data in ffs_data::private_data. This clears this pointer during the ffs_free_dev clean up function. Change-Id: I1fde26421cb44084d73e8c2a1786ea3f09f952fc Signed-off-by: Jim Baxter Signed-off-by: Jiada Wang Signed-off-by: Harish Jenny K N Signed-off-by: Felipe Balbi Signed-off-by: William Wu (cherry picked from commit 3262ad824307c275922161e82c2db1458822f28c) --- drivers/usb/gadget/function/f_fs.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c index 60075b5f9f27..f613694b563e 100644 --- a/drivers/usb/gadget/function/f_fs.c +++ b/drivers/usb/gadget/function/f_fs.c @@ -3381,6 +3381,11 @@ static void _ffs_free_dev(struct ffs_dev *dev) list_del(&dev->entry); if (dev->name_allocated) kfree(dev->name); + + /* Clear the private_data pointer to stop incorrect dev access */ + if (dev->ffs_data) + dev->ffs_data->private_data = NULL; + kfree(dev); if (list_empty(&ffs_devices)) functionfs_cleanup();