On 20-03-26 11:30:33, Sriharsha Allenki wrote:
> In AIO case, the request is freed up if ep_queue fails.
> However, io_data->req still has the reference to this freed
> request. In the case of this failure if there is aio_cancel
> call on this io_data it will lead to an invalid dequeue
> operation and a potential use after free issue.
> Fix this by setting the io_data->req to NULL when the request
> is freed as part of queue failure.
>
> Signed-off-by: Sriharsha Allenki <sallenki@xxxxxxxxxxxxxx>
Reviewed-by: Peter Chen <peter.chen@xxxxxxx>
Peter
> ---
> drivers/usb/gadget/function/f_fs.c | 1 +
> 1 file changed, 1 insertion(+)
>
> diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c
> index 571917677d35..767f30b86645 100644
> --- a/drivers/usb/gadget/function/f_fs.c
> +++ b/drivers/usb/gadget/function/f_fs.c
> @@ -1120,6 +1120,7 @@ static ssize_t ffs_epfile_io(struct file *file, struct ffs_io_data *io_data)
>
> ret = usb_ep_queue(ep->ep, req, GFP_ATOMIC);
> if (unlikely(ret)) {
> + io_data->req = NULL;
> usb_ep_free_request(ep->ep, req);
> goto error_lock;
> }
> --
> The Qualcomm Innovation Center, Inc. is a member of the Code Aurora Forum, a Linux Foundation Collaborative Project
--
Thanks,
Peter Chen
