lkml.org 
[lkml]   [2020]   [Apr]   [16]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.19 048/146] usb: gadget: f_fs: Fix use after free issue as part of queue failure
    Date
    From: Sriharsha Allenki <sallenki@codeaurora.org>

    commit f63ec55ff904b2f2e126884fcad93175f16ab4bb upstream.

    In AIO case, the request is freed up if ep_queue fails.
    However, io_data->req still has the reference to this freed
    request. In the case of this failure if there is aio_cancel
    call on this io_data it will lead to an invalid dequeue
    operation and a potential use after free issue.
    Fix this by setting the io_data->req to NULL when the request
    is freed as part of queue failure.

    Fixes: 2e4c7553cd6f ("usb: gadget: f_fs: add aio support")
    Signed-off-by: Sriharsha Allenki <sallenki@codeaurora.org>
    CC: stable <stable@vger.kernel.org>
    Reviewed-by: Peter Chen <peter.chen@nxp.com>
    Link: https://lore.kernel.org/r/20200326115620.12571-1-sallenki@codeaurora.org
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    drivers/usb/gadget/function/f_fs.c | 1 +
    1 file changed, 1 insertion(+)

    --- a/drivers/usb/gadget/function/f_fs.c
    +++ b/drivers/usb/gadget/function/f_fs.c
    @@ -1036,6 +1036,7 @@ static ssize_t ffs_epfile_io(struct file

    ret = usb_ep_queue(ep->ep, req, GFP_ATOMIC);
    if (unlikely(ret)) {
    + io_data->req = NULL;
    usb_ep_free_request(ep->ep, req);
    goto error_lock;
    }

    \
     
     \ /
      Last update: 2020-04-16 15:30    [W:4.218 / U:0.388 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site