Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 6e76c01e authored by Alan Stern's avatar Alan Stern Committed by Greg Kroah-Hartman
Browse files

USB: gadgetfs: fix copy_to_user while holding spinlock 



The gadgetfs driver as a long-outstanding FIXME, regarding a call of
copy_to_user() made while holding a spinlock.  This patch fixes the
issue by dropping the spinlock and using the dev->udc_usage mechanism
introduced by another recent patch to guard against status changes
while the lock isn't held.

Signed-off-by: default avatarAlan Stern <stern@rowland.harvard.edu>
Reported-by: default avatarAndrey Konovalov <andreyknvl@google.com>
CC: <stable@vger.kernel.org>
Acked-by: default avatarFelipe Balbi <felipe.balbi@linux.intel.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 786de92b

drivers/usb/gadget/legacy/inode.c

+4 −1
Original line number Diff line number Diff line
@@ -983,11 +983,14 @@ ep0_read (struct file *fd, char __user *buf, size_t len, loff_t *ptr) 
				retval = -EIO;

			else {

				len = min (len, (size_t)dev->req->actual);

// FIXME don't call this with the spinlock held ...

				++dev->udc_usage;

				spin_unlock_irq(&dev->lock);

				if (copy_to_user (buf, dev->req->buf, len))

					retval = -EFAULT;

				else

					retval = len;

				spin_lock_irq(&dev->lock);

				--dev->udc_usage;

				clean_req (dev->gadget->ep0, dev->req);

				/* NOTE userspace can't yet choose to stall */

			}