[lvc-project] [PATCH] usb: gadget: fix device data management error in gadgetfs_bind()

[Dmitry Antipov]

In 'gadgetfs_bind()', 'get_dev()' on appropriate 'struct dev_data'
instance should be performed immediately after the pointer is stored.
Otherwise an attempt to handle -ENOMEM later will issue an unbalanced
'put_dev()' in 'gadgetfs_unbind()', thus leading to UAF errors.

Reported-by: syzbot+6aa97991da41499aa852 at syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=6aa97991da41499aa852
Cc: stable at vger.kernel.org
Signed-off-by: Dmitry Antipov <dmantipov at yandex.ru>
---
 drivers/usb/gadget/legacy/inode.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/usb/gadget/legacy/inode.c b/drivers/usb/gadget/legacy/inode.c
index d87a8ab51510..a86a1c68903e 100644
--- a/drivers/usb/gadget/legacy/inode.c
+++ b/drivers/usb/gadget/legacy/inode.c
@@ -1681,6 +1681,7 @@ static int gadgetfs_bind(struct usb_gadget *gadget,
 	set_gadget_data (gadget, dev);
 	dev->gadget = gadget;
 	gadget->ep0->driver_data = dev;
+	get_dev(dev);
 
 	/* preallocate control response and buffer */
 	dev->req = usb_ep_alloc_request (gadget->ep0, GFP_KERNEL);
@@ -1696,7 +1697,6 @@ static int gadgetfs_bind(struct usb_gadget *gadget,
 	spin_lock_irq(&dev->lock);
 	dev->state = STATE_DEV_UNCONNECTED;
 	spin_unlock_irq(&dev->lock);
-	get_dev (dev);
 	return 0;
 
 enomem:
-- 
2.55.0