Tom Rix 2add73c8c0 USB: cdc-acm: rework notification_buffer resizing ... commit f4b9d8a582 upstream. Clang static analysis reports this error cdc-acm.c:409:3: warning: Use of memory after it is freed acm_process_notification(acm, (unsigned char *)dr); There are three problems, the first one is that dr is not reset The variable dr is set with if (acm->nb_index) dr = (struct usb_cdc_notification *)acm->notification_buffer; But if the notification_buffer is too small it is resized with if (acm->nb_size) { kfree(acm->notification_buffer); acm->nb_size = 0; } alloc_size = roundup_pow_of_two(expected_size); /* * kmalloc ensures a valid notification_buffer after a * use of kfree in case the previous allocation was too * small. Final freeing is done on disconnect. */ acm->notification_buffer = kmalloc(alloc_size, GFP_ATOMIC); dr should point to the new acm->notification_buffer. The second problem is any data in the notification_buffer is lost when the pointer is freed. In the normal case, the current data is accumulated in the notification_buffer here. memcpy(&acm->notification_buffer[acm->nb_index], urb->transfer_buffer, copy_size); When a resize happens, anything before notification_buffer[acm->nb_index] is garbage. The third problem is the acm->nb_index is not reset on a resizing buffer error. So switch resizing to using krealloc and reassign dr and reset nb_index. Fixes: ea2583529c ("cdc-acm: reassemble fragmented notifications") Signed-off-by: Tom Rix <trix@redhat.com> Cc: stable <stable@vger.kernel.org> Acked-by: Oliver Neukum <oneukum@suse.com> Link: https://lore.kernel.org/r/20200801152154.20683-1-trix@redhat.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2020-09-03 11:27:08 +02:00
..
Kconfig	docs: usb: rename files to .rst and add them to drivers-api	2019-06-20 14:28:36 +02:00
Makefile	USB: add SPDX identifiers to all remaining Makefiles	2017-11-07 15:53:48 +01:00
cdc-acm.c	USB: cdc-acm: rework notification_buffer resizing	2020-09-03 11:27:08 +02:00
cdc-acm.h	cdc-acm: introduce a cool down	2020-04-29 16:33:22 +02:00
cdc-wdm.c	USB: cdc-wdm: fix race between write and disconnect due to flag abuse	2019-08-28 22:48:38 +02:00
usblp.c	usblp: poison URBs upon disconnect	2020-06-24 17:50:13 +02:00
usbtmc.c	Merge 5.3-rc7 into usb-next	2019-09-02 19:31:18 +02:00