CVE-2021-46933

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> usb: gadget: f_fs: Clear ffs_eventfd in ffs_data_clear.<br /> <br /> ffs_data_clear is indirectly called from both ffs_fs_kill_sb and<br /> ffs_ep0_release, so it ends up being called twice when userland closes ep0<br /> and then unmounts f_fs.<br /> If userland provided an eventfd along with function&amp;#39;s USB descriptors, it<br /> ends up calling eventfd_ctx_put as many times, causing a refcount<br /> underflow.<br /> NULL-ify ffs_eventfd to prevent these extraneous eventfd_ctx_put calls.<br /> <br /> Also, set epfiles to NULL right after de-allocating it, for readability.<br /> <br /> For completeness, ffs_data_clear actually ends up being called thrice, the<br /> last call being before the whole ffs structure gets freed, so when this<br /> specific sequence happens there is a second underflow happening (but not<br /> being reported):<br /> <br /> /sys/kernel/debug/tracing# modprobe usb_f_fs<br /> /sys/kernel/debug/tracing# echo ffs_data_clear &gt; set_ftrace_filter<br /> /sys/kernel/debug/tracing# echo function &gt; current_tracer<br /> /sys/kernel/debug/tracing# echo 1 &gt; tracing_on<br /> (setup gadget, run and kill function userland process, teardown gadget)<br /> /sys/kernel/debug/tracing# echo 0 &gt; tracing_on<br /> /sys/kernel/debug/tracing# cat trace<br /> smartcard-openp-436 [000] ..... 1946.208786: ffs_data_clear