Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commita4b98a7

Browse files
Vamsi Krishna Samavedamgregkh
Vamsi Krishna Samavedam
authored andcommitted
usb: gadget: f_fs: Use local copy of descriptors for userspace copy
The function may be unbound causing the ffs_ep and its descriptorsto be freed while userspace is in the middle of an ioctl requestingthe same descriptors. Avoid dangling pointer reference by firstmaking a local copy of desctiptors before releasing the spinlock.Fixes:c559a35 ("usb: gadget: f_fs: add ioctl returning ep descriptor")Reviewed-by: Peter Chen <peter.chen@nxp.com>Signed-off-by: Vamsi Krishna Samavedam <vskrishn@codeaurora.org>Signed-off-by: Jack Pham <jackp@codeaurora.org>Cc: stable <stable@vger.kernel.org>Link:https://lore.kernel.org/r/20201130203453.28154-1-jackp@codeaurora.orgSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
1 parent45c5775 commita4b98a7

File tree

1 file changed

+4
-2
lines changed
  • drivers/usb/gadget/function

1 file changed

+4
-2
lines changed

‎drivers/usb/gadget/function/f_fs.c‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1324,7 +1324,7 @@ static long ffs_epfile_ioctl(struct file *file, unsigned code,
13241324
caseFUNCTIONFS_ENDPOINT_DESC:
13251325
{
13261326
intdesc_idx;
1327-
structusb_endpoint_descriptor*desc;
1327+
structusb_endpoint_descriptordesc1,*desc;
13281328

13291329
switch (epfile->ffs->gadget->speed) {
13301330
caseUSB_SPEED_SUPER:
@@ -1336,10 +1336,12 @@ static long ffs_epfile_ioctl(struct file *file, unsigned code,
13361336
default:
13371337
desc_idx=0;
13381338
}
1339+
13391340
desc=epfile->ep->descs[desc_idx];
1341+
memcpy(&desc1,desc,desc->bLength);
13401342

13411343
spin_unlock_irq(&epfile->ffs->eps_lock);
1342-
ret=copy_to_user((void__user*)value,desc,desc->bLength);
1344+
ret=copy_to_user((void__user*)value,&desc1,desc1.bLength);
13431345
if (ret)
13441346
ret=-EFAULT;
13451347
returnret;

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp