Patch "usb: gadget: f_fs: Prevent race during ffs_ep0_queue_wait" has been added to the 4.14-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    usb: gadget: f_fs: Prevent race during ffs_ep0_queue_wait

to the 4.14-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     usb-gadget-f_fs-prevent-race-during-ffs_ep0_queue_wa.patch
and it can be found in the queue-4.14 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit d054b9af60303ed195c8c5e5274264c701c0891f
Author: Udipto Goswami <quic_ugoswami@xxxxxxxxxxx>
Date:   Thu Dec 15 10:59:05 2022 +0530

    usb: gadget: f_fs: Prevent race during ffs_ep0_queue_wait
    
    [ Upstream commit 6a19da111057f69214b97c62fb0ac59023970850 ]
    
    While performing fast composition switch, there is a possibility that the
    process of ffs_ep0_write/ffs_ep0_read get into a race condition
    due to ep0req being freed up from functionfs_unbind.
    
    Consider the scenario that the ffs_ep0_write calls the ffs_ep0_queue_wait
    by taking a lock &ffs->ev.waitq.lock. However, the functionfs_unbind isn't
    bounded so it can go ahead and mark the ep0req to NULL, and since there
    is no NULL check in ffs_ep0_queue_wait we will end up in use-after-free.
    
    Fix this by making a serialized execution between the two functions using
    a mutex_lock(ffs->mutex).
    
    Fixes: ddf8abd25994 ("USB: f_fs: the FunctionFS driver")
    Signed-off-by: Udipto Goswami <quic_ugoswami@xxxxxxxxxxx>
    Tested-by: Krishna Kurapati <quic_kriskura@xxxxxxxxxxx>
    Link: https://lore.kernel.org/r/20221215052906.8993-2-quic_ugoswami@xxxxxxxxxxx
    Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c
index 13a38ed806df..df880fe73088 100644
--- a/drivers/usb/gadget/function/f_fs.c
+++ b/drivers/usb/gadget/function/f_fs.c
@@ -274,6 +274,9 @@ static int __ffs_ep0_queue_wait(struct ffs_data *ffs, char *data, size_t len)
 	struct usb_request *req = ffs->ep0req;
 	int ret;
 
+	if (!req)
+		return -EINVAL;
+
 	req->zero     = len < le16_to_cpu(ffs->ev.setup.wLength);
 
 	spin_unlock_irq(&ffs->ev.waitq.lock);
@@ -1797,10 +1800,12 @@ static void functionfs_unbind(struct ffs_data *ffs)
 	ENTER();
 
 	if (!WARN_ON(!ffs->gadget)) {
+		mutex_lock(&ffs->mutex);
 		usb_ep_free_request(ffs->gadget->ep0, ffs->ep0req);
 		ffs->ep0req = NULL;
 		ffs->gadget = NULL;
 		clear_bit(FFS_FL_BOUND, &ffs->flags);
+		mutex_unlock(&ffs->mutex);
 		ffs_data_put(ffs);
 	}
 }