leandrof/linux
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
520b72fc64
linux/drivers
History
Alan Stern 520b72fc64 USB: gadgetfs: Fix crash caused by inadequate synchronization 
The gadgetfs driver (drivers/usb/gadget/legacy/inode.c) was written
before the UDC and composite frameworks were adopted; it is a legacy
driver.  As such, it expects that once bound to a UDC controller, it
will not be unbound until it unregisters itself.

However, the UDC framework does unbind function drivers while they are
still registered.  When this happens, it can cause the gadgetfs driver
to misbehave or crash.  For example, userspace can cause a crash by
opening the device file and doing an ioctl call before setting up a
configuration (found by Andrey Konovalov using the syzkaller fuzzer).

This patch adds checks and synchronization to prevent these bad
behaviors.  It adds a udc_usage counter that the driver increments at
times when it is using a gadget interface without holding the private
spinlock.  The unbind routine waits for this counter to go to 0 before
returning, thereby ensuring that the UDC is no longer in use.

The patch also adds a check in the dev_ioctl() routine to make sure
the driver is bound to a UDC before dereferencing the gadget pointer,
and it makes destroy_ep_files() synchronize with the endpoint I/O
routines, to prevent the user from accessing an endpoint data
structure after it has been removed.

Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Reported-by: Andrey Konovalov <andreyknvl@google.com>
Tested-by: Andrey Konovalov <andreyknvl@google.com>
CC: <stable@vger.kernel.org>
Acked-by: Felipe Balbi <felipe.balbi@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-09-22 18:29:00 +02:00
..
accessibility
acpi dmi: Mark all struct dmi_system_id instances const 2017-09-14 11:59:30 +02:00
amba
android ANDROID: binder: don't queue async transactions to thread. 2017-09-01 09:22:50 +02:00
ata Merge branch 'for-4.14' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/libata 2017-09-06 22:41:21 -07:00
atm
auxdisplay
base firmware: Restore support for built-in firmware 2017-09-16 10:58:48 -07:00
bcma
block The highlights include: 2017-09-12 20:03:53 -07:00
bluetooth
bus ARM: SoC driver updates for v4.14 2017-09-10 20:40:00 -07:00
cdrom
char dmi: Mark all struct dmi_system_id instances const 2017-09-14 11:59:30 +02:00
clk The diff is dominated by the Allwinner A10/A20 SoCs getting converted to 2017-09-13 11:04:14 -07:00
clocksource Merge branch '4.14-features' of git://git.linux-mips.org/pub/scm/ralf/upstream-linus 2017-09-15 20:43:33 -07:00
connector
cpufreq dmi: Mark all struct dmi_system_id instances const 2017-09-14 11:59:30 +02:00
cpuidle Merge branch '4.14-features' of git://git.linux-mips.org/pub/scm/ralf/upstream-linus 2017-09-15 20:43:33 -07:00
crypto dmaengine updates for 4.14-rc1 2017-09-07 14:03:05 -07:00
dax - Some request-based DM core and DM multipath fixes and cleanups 2017-09-14 13:43:16 -07:00
dca
devfreq
dio
dma dmaengine updates for 4.14-rc1 2017-09-07 14:03:05 -07:00
dma-buf
edac
eisa
extcon
firewire
firmware dmi: Mark all struct dmi_system_id instances const 2017-09-14 11:59:30 +02:00
fmc
fpga
fsi
gpio - New Drivers 2017-09-07 13:51:13 -07:00
gpu amd fixes pull 2017-09-15 17:52:52 -07:00
hid media updates for v4.14-rc1 2017-09-07 12:53:14 -07:00
hsi
hv Merge branch 'x86-platform-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip 2017-09-07 09:25:15 -07:00
hwmon dmi: Mark all struct dmi_system_id instances const 2017-09-14 11:59:30 +02:00
hwspinlock
hwtracing
i2c i2c: i2c-stm32f7: add driver 2017-09-14 17:34:43 +02:00
ide Merge branch 'for-4.14/block' of git://git.kernel.dk/linux-block 2017-09-07 11:59:42 -07:00
idle Power management updates for v4.14-rc1 2017-09-05 12:19:08 -07:00
iio - New Drivers 2017-09-07 13:51:13 -07:00
infiniband IB/mlx4: fix sprintf format warning 2017-09-13 18:53:15 -07:00
input Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input 2017-09-16 11:24:26 -07:00
iommu IOMMU Updates for Linux v4.14 2017-09-09 15:03:24 -07:00
ipack
irqchip Merge branch '4.14-features' of git://git.linux-mips.org/pub/scm/ralf/upstream-linus 2017-09-15 20:43:33 -07:00
isdn isdn: isdnloop: fix logic error in isdnloop_sendbuf 2017-09-07 20:03:54 -07:00
leds dmi: Mark all struct dmi_system_id instances const 2017-09-14 11:59:30 +02:00
lightnvm
macintosh powerpc/macintosh: constify wf_sensor_ops structures 2017-09-01 16:42:54 +10:00
mailbox Just behavorial changes to a controller driver: 2017-09-07 13:23:37 -07:00
mcb Char/Misc drivers for 4.14-rc1 2017-09-05 11:08:17 -07:00
md - Some request-based DM core and DM multipath fixes and cleanups 2017-09-14 13:43:16 -07:00
media Merge branch 'work.set_fs' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 2017-09-14 18:13:32 -07:00
memory ARM: SoC driver updates for v4.14 2017-09-10 20:40:00 -07:00
memstick
message
mfd dmi: Mark all struct dmi_system_id instances const 2017-09-14 11:59:30 +02:00
misc mm: treewide: remove GFP_TEMPORARY allocation flag 2017-09-13 18:53:16 -07:00
mmc mmc: renesas_sdhi: Add r8a7743/5 support 2017-09-01 15:31:01 +02:00
mtd This pull request contains updates for UBI: 2017-09-16 12:08:10 -07:00
mux
net Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2017-09-16 11:28:59 -07:00
nfc
ntb
nubus
nvdimm - Some request-based DM core and DM multipath fixes and cleanups 2017-09-14 13:43:16 -07:00
nvme nvme-pci: implement the HMB entry number and size limitations 2017-09-11 12:29:40 -04:00
nvmem
of dma-mapping updates for 4.14: 2017-09-12 13:30:06 -07:00
oprofile
parisc
parport Char/Misc drivers for 4.14-rc1 2017-09-05 11:08:17 -07:00
pci Revert "PCI: Avoid race while enabling upstream bridges" 2017-09-15 01:33:51 -05:00
pcmcia
perf
phy Merge branch '4.14-features' of git://git.linux-mips.org/pub/scm/ralf/upstream-linus 2017-09-15 20:43:33 -07:00
pinctrl pinctrl/amd: save pin registers over suspend/resume 2017-09-12 15:58:45 +02:00
platform dmi: Mark all struct dmi_system_id instances const 2017-09-14 11:59:30 +02:00
pnp dmi: Mark all struct dmi_system_id instances const 2017-09-14 11:59:30 +02:00
power power supply and reset changes for the v4.14 series 2017-09-09 14:44:39 -07:00
powercap
pps drivers/pps: use surrounding "if PPS" to remove numerous dependency checks 2017-09-08 18:26:51 -07:00
ps3
ptp
pwm pwm: Changes for v4.14-rc1 2017-09-11 13:04:32 -07:00
rapidio
ras
regulator - New Drivers 2017-09-07 13:51:13 -07:00
remoteproc rpmsg updates for v4.14 2017-09-09 14:34:38 -07:00
reset Merge branch '4.14-features' of git://git.linux-mips.org/pub/scm/ralf/upstream-linus 2017-09-15 20:43:33 -07:00
rpmsg rpmsg: glink: initialize ret to zero to ensure error status check is correct 2017-09-04 10:52:30 -07:00
rtc RTC for 4.14 2017-09-13 10:56:00 -07:00
s390 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux 2017-09-12 06:01:59 -07:00
sbus
scsi SCSI misc on 20170913 2017-09-13 10:47:14 -07:00
sfi
sh
sn
soc Merge branch '4.14-features' of git://git.linux-mips.org/pub/scm/ralf/upstream-linus 2017-09-15 20:43:33 -07:00
spi ACPI updates for v4.14-rc1 2017-09-05 12:45:03 -07:00
spmi
ssb
staging Merge branch 'work.mount' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 2017-09-14 18:54:01 -07:00
target Merge branch 'work.set_fs' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 2017-09-14 18:13:32 -07:00
tc
tee
thermal Merge branches 'thermal-core', 'thermal-soc', 'thermal-intel' and 'const-thermal-zone-structure' into next 2017-09-08 11:20:04 +08:00
thunderbolt ACPI updates for v4.14-rc1 2017-09-05 12:45:03 -07:00
tty dmi: Mark all struct dmi_system_id instances const 2017-09-14 11:59:30 +02:00
uio
usb USB: gadgetfs: Fix crash caused by inadequate synchronization 2017-09-22 18:29:00 +02:00
uwb uwb: properly check kthread_run return value 2017-09-18 11:28:23 +02:00
vfio
vhost lib/interval_tree: fast overlap detection 2017-09-08 18:26:49 -07:00
video fbdev changes for v4.14: 2017-09-14 13:33:33 -07:00
virt
virtio SCSI misc on 20170907 2017-09-07 21:11:05 -07:00
vlynq
vme
w1 power supply and reset changes for the v4.14 series 2017-09-09 14:44:39 -07:00
watchdog Merge branch '4.14-features' of git://git.linux-mips.org/pub/scm/ralf/upstream-linus 2017-09-15 20:43:33 -07:00
xen mm: treewide: remove GFP_TEMPORARY allocation flag 2017-09-13 18:53:16 -07:00
zorro
Kconfig
Makefile