Re: [PATCH] usb: gadget: f_fs: Fix use after free issue as part of queue failure

[Peter Chen <peter.chen@nxp.com>]

On 20-03-26 11:30:33, Sriharsha Allenki wrote:
> In AIO case, the request is freed up if ep_queue fails.
> However, io_data->req still has the reference to this freed
> request. In the case of this failure if there is aio_cancel
> call on this io_data it will lead to an invalid dequeue
> operation and a potential use after free issue.
> Fix this by setting the io_data->req to NULL when the request
> is freed as part of queue failure.
> 
> Signed-off-by: Sriharsha Allenki <sallenki@codeaurora.org>

Reviewed-by: Peter Chen <peter.chen@nxp.com>

Peter
> ---
>  drivers/usb/gadget/function/f_fs.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c
> index 571917677d35..767f30b86645 100644
> --- a/drivers/usb/gadget/function/f_fs.c
> +++ b/drivers/usb/gadget/function/f_fs.c
> @@ -1120,6 +1120,7 @@ static ssize_t ffs_epfile_io(struct file *file, struct ffs_io_data *io_data)
>  
>  		ret = usb_ep_queue(ep->ep, req, GFP_ATOMIC);
>  		if (unlikely(ret)) {
> +			io_data->req = NULL;
>  			usb_ep_free_request(ep->ep, req);
>  			goto error_lock;
>  		}
> -- 
> The Qualcomm Innovation Center, Inc. is a member of the Code Aurora Forum, a Linux Foundation Collaborative Project

-- 

Thanks,
Peter Chen