Stable Archive on lore.kernel.org
 help / color / Atom feed
* [PATCH v2] usb: gadget: f_fs: Fix use after free issue as part of queue failure
@ 2020-03-26 11:56 Sriharsha Allenki
  2020-03-27 15:03 ` Sasha Levin
  0 siblings, 1 reply; 2+ messages in thread
From: Sriharsha Allenki @ 2020-03-26 11:56 UTC (permalink / raw)
  To: balbi, gregkh, linux-usb
  Cc: peter.chen, stable, mgautam, jackp, Sriharsha Allenki

In AIO case, the request is freed up if ep_queue fails.
However, io_data->req still has the reference to this freed
request. In the case of this failure if there is aio_cancel
call on this io_data it will lead to an invalid dequeue
operation and a potential use after free issue.
Fix this by setting the io_data->req to NULL when the request
is freed as part of queue failure.

Fixes: 2e4c7553cd6f ("usb: gadget: f_fs: add aio support")
Signed-off-by: Sriharsha Allenki <sallenki@codeaurora.org>
CC: stable <stable@vger.kernel.org>
Reviewed-by: Peter Chen <peter.chen@nxp.com>
---
Changes in v2:
	- As suggested by Greg, updated the tags

 drivers/usb/gadget/function/f_fs.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c
index 571917677d35..767f30b86645 100644
--- a/drivers/usb/gadget/function/f_fs.c
+++ b/drivers/usb/gadget/function/f_fs.c
@@ -1120,6 +1120,7 @@ static ssize_t ffs_epfile_io(struct file *file, struct ffs_io_data *io_data)
 
 		ret = usb_ep_queue(ep->ep, req, GFP_ATOMIC);
 		if (unlikely(ret)) {
+			io_data->req = NULL;
 			usb_ep_free_request(ep->ep, req);
 			goto error_lock;
 		}
-- 
The Qualcomm Innovation Center, Inc. is a member of the Code Aurora Forum, a Linux Foundation Collaborative Project

^ permalink raw reply	[flat|nested] 2+ messages in thread

* Re: [PATCH v2] usb: gadget: f_fs: Fix use after free issue as part of queue failure
  2020-03-26 11:56 [PATCH v2] usb: gadget: f_fs: Fix use after free issue as part of queue failure Sriharsha Allenki
@ 2020-03-27 15:03 ` Sasha Levin
  0 siblings, 0 replies; 2+ messages in thread
From: Sasha Levin @ 2020-03-27 15:03 UTC (permalink / raw)
  To: Sasha Levin, Sriharsha Allenki, balbi, gregkh
  Cc: peter.chen, stable, mgautam, stable, stable

Hi

[This is an automated email]

This commit has been processed because it contains a "Fixes:" tag
fixing commit: 2e4c7553cd6f ("usb: gadget: f_fs: add aio support").

The bot has tested the following trees: v5.5.11, v5.4.27, v4.19.112, v4.14.174, v4.9.217, v4.4.217.

v5.5.11: Build OK!
v5.4.27: Build OK!
v4.19.112: Build OK!
v4.14.174: Build OK!
v4.9.217: Build OK!
v4.4.217: Failed to apply! Possible dependencies:
    3163c79efa65 ("usb: f_fs: fix ffs_epfile_io returning success on req alloc failure")
    3de4e2056817 ("usb: f_fs: fix memory leak when ep changes during transfer")
    ae76e13477d8 ("usb: f_fs: refactor ffs_epfile_io")


NOTE: The patch will not be queued to stable trees until it is upstream.

How should we proceed with this patch?

-- 
Thanks
Sasha

^ permalink raw reply	[flat|nested] 2+ messages in thread

end of thread, back to index

Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-03-26 11:56 [PATCH v2] usb: gadget: f_fs: Fix use after free issue as part of queue failure Sriharsha Allenki
2020-03-27 15:03 ` Sasha Levin

Stable Archive on lore.kernel.org

Archives are clonable:
	git clone --mirror https://lore.kernel.org/stable/0 stable/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 stable stable/ https://lore.kernel.org/stable \
		stable@vger.kernel.org
	public-inbox-index stable

Example config snippet for mirrors

Newsgroup available over NNTP:
	nntp://nntp.lore.kernel.org/org.kernel.vger.stable


AGPL code for this site: git clone https://public-inbox.org/public-inbox.git