From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id AE730F9D4; Tue, 14 May 2024 11:59:36 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1715687976; cv=none; b=stiE+jkOqmCJSmF4H5D/oQ+DyfWvKS7FZHPa4wmXz3srEmoxf0qMdasjP0B/nxJg5t9Mr9frsphREypIri9nX/nLI+BIfbYFzZ1Eu2qIJpATJs3pPq3fRW8hvQuKHDGmOZHKekksp8ynEUlPUd1OzoNuwdG3BtnU6fn9MOS5yaE= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1715687976; c=relaxed/simple; bh=LFkr9uwHs++i8g8JokYF+LT/8sDBIhEy0D5CsF8IK0g=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=jGmljh5aJMSrNRGOJCIIw1SiuVYIbWlYYBxMj4xyN6sbNm+HB4Q1ZFiLSNoquNkdKKjVMQeOSrH0mZPLgxwQKSx5zfFiJVOp3bjb1BXZXfH5epu8svSKybHKaKlVVcXQOB8QmnrhvQhVYIRaA9TNyjIO1uKvnsxN6sNEZjxLEiU= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=tg5JXv6K; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="tg5JXv6K" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 39082C2BD10; Tue, 14 May 2024 11:59:36 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1715687976; bh=LFkr9uwHs++i8g8JokYF+LT/8sDBIhEy0D5CsF8IK0g=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=tg5JXv6K2EaZDh928FPfNWBvpwokcJev6oJassBNe+fkIairSHT/FEID2OBKf3JsY x8at8ypwZdYgSYJgKKP1hV7wRTp0X/X4NcreCzfopNi2z5QORkxFfs1sfE1ixW0ONN nizZwjVaDSRLEwUFDksLCEMZxm4TaGB51uBUnO0Q= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, stable , Chris Wulff Subject: [PATCH 5.15 146/168] usb: gadget: f_fs: Fix a race condition when processing setup packets. Date: Tue, 14 May 2024 12:20:44 +0200 Message-ID: <20240514101012.276602729@linuxfoundation.org> X-Mailer: git-send-email 2.45.0 In-Reply-To: <20240514101006.678521560@linuxfoundation.org> References: <20240514101006.678521560@linuxfoundation.org> User-Agent: quilt/0.67 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: stable@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 5.15-stable review patch. If anyone has any objections, please let me know. ------------------ From: Chris Wulff commit 0aea736ddb877b93f6d2dd8cf439840d6b4970a9 upstream. If the USB driver passes a pointer into the TRB buffer for creq, this buffer can be overwritten with the status response as soon as the event is queued. This can make the final check return USB_GADGET_DELAYED_STATUS when it shouldn't. Instead use the stored wLength. Fixes: 4d644abf2569 ("usb: gadget: f_fs: Only return delayed status when len is 0") Cc: stable Signed-off-by: Chris Wulff Link: https://lore.kernel.org/r/CO1PR17MB5419BD664264A558B2395E28E1112@CO1PR17MB5419.namprd17.prod.outlook.com Signed-off-by: Greg Kroah-Hartman --- drivers/usb/gadget/function/f_fs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/usb/gadget/function/f_fs.c +++ b/drivers/usb/gadget/function/f_fs.c @@ -3414,7 +3414,7 @@ static int ffs_func_setup(struct usb_fun __ffs_event_add(ffs, FUNCTIONFS_SETUP); spin_unlock_irqrestore(&ffs->ev.waitq.lock, flags); - return creq->wLength == 0 ? USB_GADGET_DELAYED_STATUS : 0; + return ffs->ev.setup.wLength == 0 ? USB_GADGET_DELAYED_STATUS : 0; } static bool ffs_func_req_match(struct usb_function *f,