Message-ID: <1457162429.19657.277.camel@haakon3.risingtidesystems.com>
Subject: Re: [patch -target tree] usb: gadget: f_tcm: use after free
From: "Nicholas A. Bellinger" <nab@linux-iscsi.org>
To: Dan Carpenter <dan.carpenter@oracle.com>
Cc: Felipe Balbi <balbi@kernel.org>, Christoph Hellwig <hch@lst.de>,
        Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
        Sebastian Andrzej Siewior <bigeasy@linutronix.de>,
        Andrzej Pietrasiewicz <andrzej.p@samsung.com>,
        Bart Van Assche <bart.vanassche@sandisk.com>,
        linux-usb@vger.kernel.org, linux-kernel@vger.kernel.org,
        target-devel@vger.kernel.org
Date: Fri, 04 Mar 2016 23:20:29 -0800
In-Reply-To: <20160302100848.GC5533@mwanda>
References: <20160302100848.GC5533@mwanda>
Content-Type: text/plain; charset="UTF-8"
Mime-Version: 1.0
Content-Transfer-Encoding: 7bit
Sender: linux-kernel-owner@vger.kernel.org
Content-Length: 903
Lines: 25

On Wed, 2016-03-02 at 13:08 +0300, Dan Carpenter wrote:
> We need to move the kfree() down a line so we don't dereference a freed
> variable.
> 
> Fixes: 1b418a8fcbc0 ('target: Convert demo-mode only drivers to target_alloc_session')
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
> 
> diff --git a/drivers/usb/gadget/function/f_tcm.c b/drivers/usb/gadget/function/f_tcm.c
> index 7276a73..e352a31 100644
> --- a/drivers/usb/gadget/function/f_tcm.c
> +++ b/drivers/usb/gadget/function/f_tcm.c
> @@ -1596,8 +1596,8 @@ static int tcm_usbg_make_nexus(struct usbg_tpg *tpg, char *name)
>  #define MAKE_NEXUS_MSG "core_tpg_check_initiator_node_acl() failed for %s\n"
>  		pr_debug(MAKE_NEXUS_MSG, name);
>  #undef MAKE_NEXUS_MSG
> -		kfree(tv_nexus);
>  		ret = PTR_ERR(tv_nexus->tvn_se_sess);
> +		kfree(tv_nexus);
>  	}
>  
>  out_unlock:

Fixed + squashed into the original patch.

Thanks Dan.