leandrof/linux
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
0a7dd4e901
linux/drivers/usb/gadget/function
History
Vamsi Krishna Samavedam a4b98a7512 usb: gadget: f_fs: Use local copy of descriptors for userspace copy 
The function may be unbound causing the ffs_ep and its descriptors
to be freed while userspace is in the middle of an ioctl requesting
the same descriptors. Avoid dangling pointer reference by first
making a local copy of desctiptors before releasing the spinlock.

Fixes: c559a35341 ("usb: gadget: f_fs: add ioctl returning ep descriptor")
Reviewed-by: Peter Chen <peter.chen@nxp.com>
Signed-off-by: Vamsi Krishna Samavedam <vskrishn@codeaurora.org>
Signed-off-by: Jack Pham <jackp@codeaurora.org>
Cc: stable <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20201130203453.28154-1-jackp@codeaurora.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-12-04 16:09:10 +01:00
..
f_acm.c usb: gadget: f_acm: don't disable disabled EP 2020-10-02 09:43:36 +03:00
f_ecm.c
f_eem.c usb: gadget: function: remove redundant assignment to variable 'status' 2020-05-25 11:09:39 +03:00
f_fs.c usb: gadget: f_fs: Use local copy of descriptors for userspace copy 2020-12-04 16:09:10 +01:00
f_hid.c usb: gadget: Use fallthrough pseudo-keyword 2020-07-10 08:55:18 +02:00
f_loopback.c
f_mass_storage.c treewide: Use fallthrough pseudo-keyword 2020-08-23 17:36:59 -05:00
f_mass_storage.h
f_midi.c usb: gadget: f_midi: Fix memleak in f_midi_alloc 2020-11-20 16:32:42 +01:00
f_ncm.c usb: gadget: f_ncm: allow using NCM in SuperSpeed Plus gadgets. 2020-10-02 09:57:41 +03:00
f_obex.c
f_phonet.c usb: gadget: Use fallthrough pseudo-keyword 2020-07-10 08:55:18 +02:00
f_printer.c usb: gadget: function: printer: fix use-after-free in __lock_acquire 2020-10-02 09:43:36 +03:00
f_rndis.c usb: gadget: Use fallthrough pseudo-keyword 2020-07-10 08:55:18 +02:00
f_serial.c usb: gadget: f_serial: add suspend resume callbacks 2020-05-25 11:09:39 +03:00
f_sourcesink.c
f_subset.c
f_tcm.c usb: gadget: config_ep_by_speed_and_alt instead of config_ep_by_speed 2020-10-02 09:57:40 +03:00
f_uac1_legacy.c usb: gadget: function: fix missing spinlock in f_uac1_legacy 2020-07-09 10:13:07 +03:00
f_uac1.c
f_uac2.c usb: gadget: f_uac2: fix AC Interface Header Descriptor wTotalLength 2020-07-24 16:45:15 +03:00
f_uvc.c usb: gadget: uvc: Fix the wrong v4l2_device_unregister call 2020-10-02 09:57:45 +03:00
f_uvc.h USB: gadget: Use the correct style for SPDX License Identifier 2020-05-05 10:58:49 +03:00
g_zero.h
Makefile
ndis.h
rndis.c
rndis.h USB: gadget: Use the correct style for SPDX License Identifier 2020-05-05 10:58:49 +03:00
storage_common.c
storage_common.h
tcm.h
u_audio.c
u_audio.h USB: gadget: Use the correct style for SPDX License Identifier 2020-05-05 10:58:49 +03:00
u_ecm.h USB: gadget: Use the correct style for SPDX License Identifier 2020-05-05 10:58:49 +03:00
u_eem.h USB: gadget: Use the correct style for SPDX License Identifier 2020-05-05 10:58:49 +03:00
u_ether_configfs.h USB: gadget: Use the correct style for SPDX License Identifier 2020-05-05 10:58:49 +03:00
u_ether.c usb: gadget: u_ether: enable qmult on SuperSpeed Plus as well 2020-10-02 09:57:41 +03:00
u_ether.h USB: gadget: Use the correct style for SPDX License Identifier 2020-05-05 10:58:49 +03:00
u_fs.h USB: gadget: Use the correct style for SPDX License Identifier 2020-05-05 10:58:49 +03:00
u_gether.h USB: gadget: Use the correct style for SPDX License Identifier 2020-05-05 10:58:49 +03:00
u_hid.h USB: gadget: Use the correct style for SPDX License Identifier 2020-05-05 10:58:49 +03:00
u_midi.h USB: gadget: Use the correct style for SPDX License Identifier 2020-05-05 10:58:49 +03:00
u_ncm.h USB: gadget: Use the correct style for SPDX License Identifier 2020-05-05 10:58:49 +03:00
u_phonet.h USB: gadget: Use the correct style for SPDX License Identifier 2020-05-05 10:58:49 +03:00
u_printer.h USB: gadget: Use the correct style for SPDX License Identifier 2020-05-05 10:58:49 +03:00
u_rndis.h USB: gadget: Use the correct style for SPDX License Identifier 2020-05-05 10:58:49 +03:00
u_serial.c usb: gadget: u_serial: clear suspended flag when disconnecting 2020-10-02 09:57:41 +03:00
u_serial.h usb: gadget: u_serial.h: increase MAX_U_SERIAL_PORTS to 8 2020-06-18 10:23:22 +02:00
u_tcm.h USB: gadget: Use the correct style for SPDX License Identifier 2020-05-05 10:58:49 +03:00
u_uac1_legacy.c usb: gadget: function: u_uac1_legacy: Demote obvious misuse of kerneldoc to standard comment blocks 2020-07-09 17:19:58 +02:00
u_uac1_legacy.h USB: gadget: Use the correct style for SPDX License Identifier 2020-05-05 10:58:49 +03:00
u_uac1.h USB: gadget: Use the correct style for SPDX License Identifier 2020-05-05 10:58:49 +03:00
u_uac2.h USB: gadget: Use the correct style for SPDX License Identifier 2020-05-05 10:58:49 +03:00
u_uvc.h USB: gadget: Use the correct style for SPDX License Identifier 2020-05-05 10:58:49 +03:00
uvc_configfs.c
uvc_configfs.h USB: gadget: Use the correct style for SPDX License Identifier 2020-05-05 10:58:49 +03:00
uvc_queue.c
uvc_queue.h
uvc_v4l2.c usb: gadget: uvc_video: add worker to handle the frame pumping 2020-05-25 11:09:38 +03:00
uvc_v4l2.h USB: gadget: Use the correct style for SPDX License Identifier 2020-05-05 10:58:49 +03:00
uvc_video.c usb: gadget: uvc_video: add worker to handle the frame pumping 2020-05-25 11:09:38 +03:00
uvc_video.h usb: gadget: uvc_video: add worker to handle the frame pumping 2020-05-25 11:09:38 +03:00
uvc.h usb: gadget: uvc_video: add worker to handle the frame pumping 2020-05-25 11:09:38 +03:00