Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 2ad53606 authored by Sriharsha Allenki's avatar Sriharsha Allenki Committed by Greg Kroah-Hartman
Browse files

usb: gadget: f_fs: Fix use after free issue as part of queue failure 



commit f63ec55ff904b2f2e126884fcad93175f16ab4bb upstream.

In AIO case, the request is freed up if ep_queue fails.
However, io_data->req still has the reference to this freed
request. In the case of this failure if there is aio_cancel
call on this io_data it will lead to an invalid dequeue
operation and a potential use after free issue.
Fix this by setting the io_data->req to NULL when the request
is freed as part of queue failure.

Fixes: 2e4c7553 ("usb: gadget: f_fs: add aio support")
Signed-off-by: default avatarSriharsha Allenki <sallenki@codeaurora.org>
CC: stable <stable@vger.kernel.org>
Reviewed-by: default avatarPeter Chen <peter.chen@nxp.com>
Link: https://lore.kernel.org/r/20200326115620.12571-1-sallenki@codeaurora.org


Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 10848d3c

drivers/usb/gadget/function/f_fs.c

+1 −0
Original line number Diff line number Diff line
@@ -1036,6 +1036,7 @@ static ssize_t ffs_epfile_io(struct file *file, struct ffs_io_data *io_data) 


		ret = usb_ep_queue(ep->ep, req, GFP_ATOMIC);

		if (unlikely(ret)) {

			io_data->req = NULL;

			usb_ep_free_request(ep->ep, req);

			goto error_lock;

		}