From: Peter Chen <hzpeterchen@gmail.com>
To: Jack Pham <jackp@codeaurora.org>
Cc: Felipe Balbi <balbi@kernel.org>,
Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
USB list <linux-usb@vger.kernel.org>,
Vamsi Krishna Samavedam <vskrishn@codeaurora.org>
Subject: Re: [PATCH] usb: gadget: f_fs: Use local copy of descriptors for userspace copy
Date: Wed, 2 Dec 2020 19:10:27 +0800 [thread overview]
Message-ID: <CAL411-rtkBS=+cQVOR=pGuVCrHTavh-E8vEzNZeidX4OEZKehA@mail.gmail.com> (raw)
In-Reply-To: <20201130203453.28154-1-jackp@codeaurora.org>
> From: Vamsi Krishna Samavedam <vskrishn@codeaurora.org>
>
> The function may be unbound causing the ffs_ep and its descriptors
> to be freed while userspace is in the middle of an ioctl requesting
> the same descriptors. Avoid dangling pointer reference by first
> making a local copy of desctiptors before releasing the spinlock.
>
> Fixes: c559a3534109 ("usb: gadget: f_fs: add ioctl returning ep descriptor")
> Signed-off-by: Vamsi Krishna Samavedam <vskrishn@codeaurora.org>
> Signed-off-by: Jack Pham <jackp@codeaurora.org>
Reviewed-by: Peter Chen <peter.chen@nxp.com>
> ---
> drivers/usb/gadget/function/f_fs.c | 6 ++++--
> 1 file changed, 4 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c
> index 046f770a76da..c727cb5de871 100644
> --- a/drivers/usb/gadget/function/f_fs.c
> +++ b/drivers/usb/gadget/function/f_fs.c
> @@ -1324,7 +1324,7 @@ static long ffs_epfile_ioctl(struct file *file, unsigned code,
> case FUNCTIONFS_ENDPOINT_DESC:
> {
> int desc_idx;
> - struct usb_endpoint_descriptor *desc;
> + struct usb_endpoint_descriptor desc1, *desc;
>
> switch (epfile->ffs->gadget->speed) {
> case USB_SPEED_SUPER:
> @@ -1336,10 +1336,12 @@ static long ffs_epfile_ioctl(struct file *file, unsigned code,
> default:
> desc_idx = 0;
> }
> +
> desc = epfile->ep->descs[desc_idx];
> + memcpy(&desc1, desc, desc->bLength);
>
> spin_unlock_irq(&epfile->ffs->eps_lock);
> - ret = copy_to_user((void __user *)value, desc, desc->bLength);
> + ret = copy_to_user((void __user *)value, &desc1, desc1.bLength);
> if (ret)
> ret = -EFAULT;
> return ret;
> --
> 2.24.0
>
prev parent reply other threads:[~2020-12-02 11:11 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-11-30 20:34 [PATCH] usb: gadget: f_fs: Use local copy of descriptors for userspace copy Jack Pham
2020-12-01 8:43 ` Peter Chen
2020-12-02 2:55 ` Jack Pham
2020-12-02 11:09 ` Peter Chen
2020-12-02 11:10 ` Peter Chen [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to='CAL411-rtkBS=+cQVOR=pGuVCrHTavh-E8vEzNZeidX4OEZKehA@mail.gmail.com' \
--to=hzpeterchen@gmail.com \
--cc=balbi@kernel.org \
--cc=gregkh@linuxfoundation.org \
--cc=jackp@codeaurora.org \
--cc=linux-usb@vger.kernel.org \
--cc=vskrishn@codeaurora.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.