* [PATCH v2] usb: gadget: f_fs: Fix use after free issue as part of queue failure
@ 2020-03-26 11:56 Sriharsha Allenki
2020-03-27 15:03 ` Sasha Levin
0 siblings, 1 reply; 2+ messages in thread
From: Sriharsha Allenki @ 2020-03-26 11:56 UTC (permalink / raw)
To: balbi, gregkh, linux-usb
Cc: peter.chen, stable, mgautam, jackp, Sriharsha Allenki
In AIO case, the request is freed up if ep_queue fails.
However, io_data->req still has the reference to this freed
request. In the case of this failure if there is aio_cancel
call on this io_data it will lead to an invalid dequeue
operation and a potential use after free issue.
Fix this by setting the io_data->req to NULL when the request
is freed as part of queue failure.
Fixes: 2e4c7553cd6f ("usb: gadget: f_fs: add aio support")
Signed-off-by: Sriharsha Allenki <sallenki@codeaurora.org>
CC: stable <stable@vger.kernel.org>
Reviewed-by: Peter Chen <peter.chen@nxp.com>
---
Changes in v2:
- As suggested by Greg, updated the tags
drivers/usb/gadget/function/f_fs.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c
index 571917677d35..767f30b86645 100644
--- a/drivers/usb/gadget/function/f_fs.c
+++ b/drivers/usb/gadget/function/f_fs.c
@@ -1120,6 +1120,7 @@ static ssize_t ffs_epfile_io(struct file *file, struct ffs_io_data *io_data)
ret = usb_ep_queue(ep->ep, req, GFP_ATOMIC);
if (unlikely(ret)) {
+ io_data->req = NULL;
usb_ep_free_request(ep->ep, req);
goto error_lock;
}
--
The Qualcomm Innovation Center, Inc. is a member of the Code Aurora Forum, a Linux Foundation Collaborative Project
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH v2] usb: gadget: f_fs: Fix use after free issue as part of queue failure
2020-03-26 11:56 [PATCH v2] usb: gadget: f_fs: Fix use after free issue as part of queue failure Sriharsha Allenki
@ 2020-03-27 15:03 ` Sasha Levin
0 siblings, 0 replies; 2+ messages in thread
From: Sasha Levin @ 2020-03-27 15:03 UTC (permalink / raw)
To: Sasha Levin, Sriharsha Allenki, balbi, gregkh
Cc: peter.chen, stable, mgautam, stable, stable
Hi
[This is an automated email]
This commit has been processed because it contains a "Fixes:" tag
fixing commit: 2e4c7553cd6f ("usb: gadget: f_fs: add aio support").
The bot has tested the following trees: v5.5.11, v5.4.27, v4.19.112, v4.14.174, v4.9.217, v4.4.217.
v5.5.11: Build OK!
v5.4.27: Build OK!
v4.19.112: Build OK!
v4.14.174: Build OK!
v4.9.217: Build OK!
v4.4.217: Failed to apply! Possible dependencies:
3163c79efa65 ("usb: f_fs: fix ffs_epfile_io returning success on req alloc failure")
3de4e2056817 ("usb: f_fs: fix memory leak when ep changes during transfer")
ae76e13477d8 ("usb: f_fs: refactor ffs_epfile_io")
NOTE: The patch will not be queued to stable trees until it is upstream.
How should we proceed with this patch?
--
Thanks
Sasha
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2020-03-27 15:03 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-03-26 11:56 [PATCH v2] usb: gadget: f_fs: Fix use after free issue as part of queue failure Sriharsha Allenki
2020-03-27 15:03 ` Sasha Levin
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).