Re: [PATCH] usb: gadget: f_fs: Fix use after free issue as part of queue failure

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Thu, Mar 26, 2020 at 11:30:33AM +0530, Sriharsha Allenki wrote:
> In AIO case, the request is freed up if ep_queue fails.
> However, io_data->req still has the reference to this freed
> request. In the case of this failure if there is aio_cancel
> call on this io_data it will lead to an invalid dequeue
> operation and a potential use after free issue.
> Fix this by setting the io_data->req to NULL when the request
> is freed as part of queue failure.
> 
> Signed-off-by: Sriharsha Allenki <sallenki@xxxxxxxxxxxxxx>
> ---
>  drivers/usb/gadget/function/f_fs.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c
> index 571917677d35..767f30b86645 100644
> --- a/drivers/usb/gadget/function/f_fs.c
> +++ b/drivers/usb/gadget/function/f_fs.c
> @@ -1120,6 +1120,7 @@ static ssize_t ffs_epfile_io(struct file *file, struct ffs_io_data *io_data)
>  
>  		ret = usb_ep_queue(ep->ep, req, GFP_ATOMIC);
>  		if (unlikely(ret)) {
> +			io_data->req = NULL;
>  			usb_ep_free_request(ep->ep, req);
>  			goto error_lock;
>  		}
> -- 
> The Qualcomm Innovation Center, Inc. is a member of the Code Aurora Forum, a Linux Foundation Collaborative Project

What commit does this fix?  Should it go to stable kernels, and if so,
how far back?

thanks,

greg k-h



[Index of Archives]     [Linux Media]     [Linux Input]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]     [Old Linux USB Devel Archive]

  Powered by Linux