Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit af3f22e0 authored by Chris Wulff's avatar Chris Wulff Committed by Greg Kroah-Hartman
Browse files

usb: gadget: f_fs: Fix a race condition when processing setup packets. 



commit 0aea736ddb877b93f6d2dd8cf439840d6b4970a9 upstream.

If the USB driver passes a pointer into the TRB buffer for creq, this
buffer can be overwritten with the status response as soon as the event
is queued. This can make the final check return USB_GADGET_DELAYED_STATUS
when it shouldn't. Instead use the stored wLength.

Fixes: 4d644abf ("usb: gadget: f_fs: Only return delayed status when len is 0")
Cc: stable <stable@kernel.org>
Signed-off-by: default avatarChris Wulff <chris.wulff@biamp.com>
Link: https://lore.kernel.org/r/CO1PR17MB5419BD664264A558B2395E28E1112@CO1PR17MB5419.namprd17.prod.outlook.com


Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent c037e0eb

drivers/usb/gadget/function/f_fs.c

+1 −1
Original line number Diff line number Diff line
@@ -3304,7 +3304,7 @@ static int ffs_func_setup(struct usb_function *f, 
	__ffs_event_add(ffs, FUNCTIONFS_SETUP);

	spin_unlock_irqrestore(&ffs->ev.waitq.lock, flags);



	return creq->wLength == 0 ? USB_GADGET_DELAYED_STATUS : 0;

	return ffs->ev.setup.wLength == 0 ? USB_GADGET_DELAYED_STATUS : 0;

}



static bool ffs_func_req_match(struct usb_function *f,