Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1387813
| From | Kamal Mostafa <kamal@canonical.com> |
|---|---|
| Newsgroups | linux.kernel |
| Subject | [PATCH 4.2.y-ckt 66/93] usb: gadget: f_fs: Fix use-after-free |
| Date | 2016-04-26 20:30 +0200 |
| Message-ID | <rsfUf-3TD-45@gated-at.bofh.it> (permalink) |
| References | <rsfKx-3Nr-3@gated-at.bofh.it> |
| Organization | linux.* mail to news gateway |
4.2.8-ckt9 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Lars-Peter Clausen <lars@metafoo.de>
commit 38740a5b87d53ceb89eb2c970150f6e94e00373a upstream.
When using asynchronous read or write operations on the USB endpoints the
issuer of the IO request is notified by calling the ki_complete() callback
of the submitted kiocb when the URB has been completed.
Calling this ki_complete() callback will free kiocb. Make sure that the
structure is no longer accessed beyond that point, otherwise undefined
behaviour might occur.
Fixes: 2e4c7553cd6f ("usb: gadget: f_fs: add aio support")
Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
drivers/usb/gadget/function/f_fs.c | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)
diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c
index 6e7be91..82240db 100644
--- a/drivers/usb/gadget/function/f_fs.c
+++ b/drivers/usb/gadget/function/f_fs.c
@@ -646,6 +646,7 @@ static void ffs_user_copy_worker(struct work_struct *work)
work);
int ret = io_data->req->status ? io_data->req->status :
io_data->req->actual;
+ bool kiocb_has_eventfd = io_data->kiocb->ki_flags & IOCB_EVENTFD;
if (io_data->read && ret > 0) {
use_mm(io_data->mm);
@@ -657,13 +658,11 @@ static void ffs_user_copy_worker(struct work_struct *work)
io_data->kiocb->ki_complete(io_data->kiocb, ret, ret);
- if (io_data->ffs->ffs_eventfd &&
- !(io_data->kiocb->ki_flags & IOCB_EVENTFD))
+ if (io_data->ffs->ffs_eventfd && !kiocb_has_eventfd)
eventfd_signal(io_data->ffs->ffs_eventfd, 1);
usb_ep_free_request(io_data->ep, io_data->req);
- io_data->kiocb->private = NULL;
if (io_data->read)
kfree(io_data->to_free);
kfree(io_data->buf);
--
2.7.4
Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
[4.2.y-ckt stable] Linux 4.2.8-ckt9 stable review Kamal Mostafa <kamal@canonical.com> - 2016-04-26 20:20 +0200
[PATCH 4.2.y-ckt 01/93] usbnet: cleanup after bind() in probe() Kamal Mostafa <kamal@canonical.com> - 2016-04-26 20:20 +0200
[PATCH 4.2.y-ckt 17/93] xfrm: Fix crash observed during device unregistration and decryption Kamal Mostafa <kamal@canonical.com> - 2016-04-26 20:20 +0200
[PATCH 4.2.y-ckt 37/93] ALSA: hda/realtek - Enable the ALC292 dock fixup on the Thinkpad T460s Kamal Mostafa <kamal@canonical.com> - 2016-04-26 20:20 +0200
[PATCH 4.2.y-ckt 13/93] macvtap: always pass ethernet header in linear Kamal Mostafa <kamal@canonical.com> - 2016-04-26 20:20 +0200
[PATCH 4.2.y-ckt 41/93] ALSA: hda - Fix regression of monitor_present flag in eld proc file Kamal Mostafa <kamal@canonical.com> - 2016-04-26 20:20 +0200
[PATCH 4.2.y-ckt 07/93] cdc_ncm: toggle altsetting to force reset before setup Kamal Mostafa <kamal@canonical.com> - 2016-04-26 20:20 +0200
[PATCH 4.2.y-ckt 44/93] usb: xhci: applying XHCI_PME_STUCK_QUIRK to Intel BXT B0 host Kamal Mostafa <kamal@canonical.com> - 2016-04-26 20:20 +0200
[PATCH 4.2.y-ckt 19/93] rtnl: fix msg size calculation in if_nlmsg_size() Kamal Mostafa <kamal@canonical.com> - 2016-04-26 20:20 +0200
[PATCH 4.2.y-ckt 23/93] ipv6: Count in extension headers in skb->network_header Kamal Mostafa <kamal@canonical.com> - 2016-04-26 20:20 +0200
[PATCH 4.2.y-ckt 87/93] Input: pmic8xxx-pwrkey - fix algorithm for converting trigger delay Kamal Mostafa <kamal@canonical.com> - 2016-04-26 20:20 +0200
[PATCH 4.2.y-ckt 67/93] futex: Handle unlock_pi race gracefully Kamal Mostafa <kamal@canonical.com> - 2016-04-26 20:20 +0200
[PATCH 4.2.y-ckt 12/93] sh_eth: fix NULL pointer dereference in sh_eth_ring_format() Kamal Mostafa <kamal@canonical.com> - 2016-04-26 20:20 +0200
[PATCH 4.2.y-ckt 72/93] drm/amdgpu: use defines for CRTCs and AMFT blocks Kamal Mostafa <kamal@canonical.com> - 2016-04-26 20:30 +0200
[PATCH 4.2.y-ckt 63/93] powerpc: Update cpu_user_features2 in scan_features() Kamal Mostafa <kamal@canonical.com> - 2016-04-26 20:30 +0200
[PATCH 4.2.y-ckt 77/93] x86/mm/xen: Suppress hugetlbfs in PV guests Kamal Mostafa <kamal@canonical.com> - 2016-04-26 20:30 +0200
[PATCH 4.2.y-ckt 73/93] drm/amdgpu: bump the afmt limit for CZ, ST, Polaris Kamal Mostafa <kamal@canonical.com> - 2016-04-26 20:30 +0200
[PATCH 4.2.y-ckt 64/93] powerpc: Update TM user feature bits in scan_features() Kamal Mostafa <kamal@canonical.com> - 2016-04-26 20:30 +0200
[PATCH 4.2.y-ckt 91/93] net/mlx4_core: Avoid repeated calls to pci enable/disable Kamal Mostafa <kamal@canonical.com> - 2016-04-26 20:30 +0200
[PATCH 4.2.y-ckt 86/93] net: bcmgenet: device stats are unsigned long Kamal Mostafa <kamal@canonical.com> - 2016-04-26 20:30 +0200
[PATCH 4.2.y-ckt 66/93] usb: gadget: f_fs: Fix use-after-free Kamal Mostafa <kamal@canonical.com> - 2016-04-26 20:30 +0200
[PATCH 4.2.y-ckt 89/93] net: ethernet: davinci_emac: Fix platform_data overwrite Kamal Mostafa <kamal@canonical.com> - 2016-04-26 20:30 +0200
[PATCH 4.2.y-ckt 80/93] s390/scm_blk: fix deadlock for requests != REQ_TYPE_FS Kamal Mostafa <kamal@canonical.com> - 2016-04-26 20:30 +0200
[PATCH 4.2.y-ckt 74/93] drm/radeon: forbid mapping of userptr bo through radeon device file Kamal Mostafa <kamal@canonical.com> - 2016-04-26 20:30 +0200
[PATCH 4.2.y-ckt 92/93] atl2: Disable unimplemented scatter/gather feature Kamal Mostafa <kamal@canonical.com> - 2016-04-26 20:30 +0200
[PATCH 4.2.y-ckt 90/93] net/mlx4_core: Implement pci_resume callback Kamal Mostafa <kamal@canonical.com> - 2016-04-26 20:30 +0200
[PATCH 4.2.y-ckt 68/93] futex: Acknowledge a new waiter in counter before plist Kamal Mostafa <kamal@canonical.com> - 2016-04-26 20:30 +0200
[PATCH 4.2.y-ckt 69/93] asm-generic/futex: Re-enable preemption in futex_atomic_cmpxchg_inatomic() Kamal Mostafa <kamal@canonical.com> - 2016-04-26 20:30 +0200
[PATCH 4.2.y-ckt 75/93] amdgpu/uvd: add uvd fw version for amdgpu Kamal Mostafa <kamal@canonical.com> - 2016-04-26 20:30 +0200
[PATCH 4.2.y-ckt 79/93] x86 EDAC, sb_edac.c: Take account of channel hashing when needed Kamal Mostafa <kamal@canonical.com> - 2016-04-26 20:30 +0200
[PATCH 4.2.y-ckt 93/93] openvswitch: use flow protocol when recalculating ipv6 checksums Kamal Mostafa <kamal@canonical.com> - 2016-04-26 20:30 +0200
[PATCH 4.2.y-ckt 81/93] packet: fix heap info leak in PACKET_DIAG_MCLIST sock_diag interface Kamal Mostafa <kamal@canonical.com> - 2016-04-26 20:30 +0200
[PATCH 4.2.y-ckt 83/93] bpf/verifier: reject invalid LD_ABS | BPF_DW instruction Kamal Mostafa <kamal@canonical.com> - 2016-04-26 20:30 +0200
[PATCH 4.2.y-ckt 78/93] x86 EDAC, sb_edac.c: Repair damage introduced when "fixing" channel address Kamal Mostafa <kamal@canonical.com> - 2016-04-26 20:30 +0200
[PATCH 4.2.y-ckt 85/93] s390/spinlock: avoid yield to non existent cpu Kamal Mostafa <kamal@canonical.com> - 2016-04-26 20:30 +0200
[PATCH 4.2.y-ckt 84/93] pinctrl: single: Fix pcs_parse_bits_in_pinctrl_entry to use __ffs than ffs Kamal Mostafa <kamal@canonical.com> - 2016-04-26 20:30 +0200
[PATCH 4.2.y-ckt 82/93] net: sched: do not requeue a NULL skb Kamal Mostafa <kamal@canonical.com> - 2016-04-26 20:30 +0200
[PATCH 4.2.y-ckt 62/93] powerpc: scan_features() updates incorrect bits for REAL_LE Kamal Mostafa <kamal@canonical.com> - 2016-04-26 20:30 +0200
[PATCH 4.2.y-ckt 71/93] drm/dp/mst: Validate port in drm_dp_payload_send_msg() Kamal Mostafa <kamal@canonical.com> - 2016-04-26 20:30 +0200
[PATCH 4.2.y-ckt 70/93] ALSA: pcxhr: Fix missing mutex unlock Kamal Mostafa <kamal@canonical.com> - 2016-04-26 20:30 +0200
[PATCH 4.2.y-ckt 88/93] net: ethernet: davinci_emac: Fix Unbalanced pm_runtime_enable Kamal Mostafa <kamal@canonical.com> - 2016-04-26 20:30 +0200
[PATCH 4.2.y-ckt 54/93] pinctrl: mediatek: correct debounce time unit in mtk_gpio_set_debounce Kamal Mostafa <kamal@canonical.com> - 2016-04-26 20:40 +0200
[PATCH 4.2.y-ckt 39/93] nl80211: check netlink protocol in socket release notification Kamal Mostafa <kamal@canonical.com> - 2016-04-26 20:40 +0200
[PATCH 4.2.y-ckt 45/93] xhci: resume USB 3 roothub first Kamal Mostafa <kamal@canonical.com> - 2016-04-26 20:40 +0200
[PATCH 4.2.y-ckt 65/93] drm/radeon: add a quirk for a XFX R9 270X Kamal Mostafa <kamal@canonical.com> - 2016-04-26 20:40 +0200
[PATCH 4.2.y-ckt 49/93] USB: uas: Add a new NO_REPORT_LUNS quirk Kamal Mostafa <kamal@canonical.com> - 2016-04-26 20:40 +0200
[PATCH 4.2.y-ckt 48/93] xhci: fix 10 second timeout on removal of PCI hotpluggable xhci controllers Kamal Mostafa <kamal@canonical.com> - 2016-04-26 20:40 +0200
[PATCH 4.2.y-ckt 59/93] drm/i915/userptr: Hold mmref whilst calling get-user-pages Kamal Mostafa <kamal@canonical.com> - 2016-04-26 20:40 +0200
[PATCH 4.2.y-ckt 38/93] ALSA: usb-audio: Skip volume controls triggers hangup on Dell USB Dock Kamal Mostafa <kamal@canonical.com> - 2016-04-26 20:40 +0200
[PATCH 4.2.y-ckt 28/93] drm/qxl: fix cursor position with non-zero hotspot Kamal Mostafa <kamal@canonical.com> - 2016-04-26 20:40 +0200
[PATCH 4.2.y-ckt 35/93] kvm: x86: do not leak guest xcr0 into host interrupt handlers Kamal Mostafa <kamal@canonical.com> - 2016-04-26 20:40 +0200
[PATCH 4.2.y-ckt 55/93] crypto: sha1-mb - use corrcet pointer while completing jobs Kamal Mostafa <kamal@canonical.com> - 2016-04-26 20:40 +0200
[PATCH 4.2.y-ckt 56/93] crypto: ccp - Prevent information leakage on export Kamal Mostafa <kamal@canonical.com> - 2016-04-26 20:40 +0200
[PATCH 4.2.y-ckt 33/93] ALSA: usb-audio: Add a quirk for Plantronics BT300 Kamal Mostafa <kamal@canonical.com> - 2016-04-26 20:40 +0200
[PATCH 4.2.y-ckt 51/93] drm/radeon: fix initial connector audio value Kamal Mostafa <kamal@canonical.com> - 2016-04-26 20:40 +0200
[PATCH 4.2.y-ckt 60/93] drm/i915: Use fw_domains_put_with_fifo() on HSW Kamal Mostafa <kamal@canonical.com> - 2016-04-26 20:40 +0200
[PATCH 4.2.y-ckt 29/93] Input: gtco - fix crash on detecting device without endpoints Kamal Mostafa <kamal@canonical.com> - 2016-04-26 20:40 +0200
[PATCH 4.2.y-ckt 36/93] netlink: don't send NETLINK_URELEASE for unbound sockets Kamal Mostafa <kamal@canonical.com> - 2016-04-26 20:40 +0200
[PATCH 4.2.y-ckt 53/93] dm cache metadata: fix READ_LOCK macros and cleanup WRITE_LOCK macros Kamal Mostafa <kamal@canonical.com> - 2016-04-26 20:40 +0200
[PATCH 4.2.y-ckt 47/93] usb: xhci: fix wild pointers in xhci_mem_cleanup Kamal Mostafa <kamal@canonical.com> - 2016-04-26 20:40 +0200
[PATCH 4.2.y-ckt 46/93] usb: host: xhci: add a new quirk XHCI_NO_64BIT_SUPPORT Kamal Mostafa <kamal@canonical.com> - 2016-04-26 20:40 +0200
[PATCH 4.2.y-ckt 61/93] ALSA: hda/realtek - Add ALC3234 headset mode for Optiplex 9020m Kamal Mostafa <kamal@canonical.com> - 2016-04-26 20:40 +0200
[PATCH 4.2.y-ckt 42/93] dmaengine: dw: fix master selection Kamal Mostafa <kamal@canonical.com> - 2016-04-26 20:40 +0200
[PATCH 4.2.y-ckt 58/93] video: ARM CLCD: runtime check for Versatile Kamal Mostafa <kamal@canonical.com> - 2016-04-26 20:40 +0200
[PATCH 4.2.y-ckt 40/93] debugfs: Make automount point inodes permanently empty Kamal Mostafa <kamal@canonical.com> - 2016-04-26 20:40 +0200
[PATCH 4.2.y-ckt 57/93] dm cache metadata: fix cmd_read_lock() acquiring write lock Kamal Mostafa <kamal@canonical.com> - 2016-04-26 20:40 +0200
[PATCH 4.2.y-ckt 52/93] drm/amdgpu: when suspending, if uvd/vce was running. need to cancel delay work. Kamal Mostafa <kamal@canonical.com> - 2016-04-26 20:40 +0200
[PATCH 4.2.y-ckt 50/93] usb: hcd: out of bounds access in for_each_companion Kamal Mostafa <kamal@canonical.com> - 2016-04-26 20:40 +0200
[PATCH 4.2.y-ckt 30/93] s390/pci: add extra padding to function measurement block Kamal Mostafa <kamal@canonical.com> - 2016-04-26 20:40 +0200
[PATCH 4.2.y-ckt 34/93] assoc_array: don't call compare_object() on a node Kamal Mostafa <kamal@canonical.com> - 2016-04-26 20:40 +0200
[PATCH 4.2.y-ckt 43/93] lib: lz4: fixed zram with lz4 on big endian machines Kamal Mostafa <kamal@canonical.com> - 2016-04-26 20:40 +0200
[PATCH 4.2.y-ckt 32/93] dmaengine: hsu: correct use of channel status register Kamal Mostafa <kamal@canonical.com> - 2016-04-26 20:40 +0200
[PATCH 4.2.y-ckt 08/93] udp6: fix UDP/IPv6 encap resubmit path Kamal Mostafa <kamal@canonical.com> - 2016-04-26 20:50 +0200
[PATCH 4.2.y-ckt 31/93] ALSA: usb-audio: Add a sample rate quirk for Phoenix Audio TMX320 Kamal Mostafa <kamal@canonical.com> - 2016-04-26 20:50 +0200
[PATCH 4.2.y-ckt 15/93] qlge: Fix receive packets drop. Kamal Mostafa <kamal@canonical.com> - 2016-04-26 20:50 +0200
[PATCH 4.2.y-ckt 11/93] packet: validate variable length ll headers Kamal Mostafa <kamal@canonical.com> - 2016-04-26 20:50 +0200
[PATCH 4.2.y-ckt 27/93] ARM: mvebu: Correct unit address for linksys Kamal Mostafa <kamal@canonical.com> - 2016-04-26 20:50 +0200
[PATCH 4.2.y-ckt 26/93] ARM: OMAP2+: hwmod: Fix updating of sysconfig register Kamal Mostafa <kamal@canonical.com> - 2016-04-26 20:50 +0200
[PATCH 4.2.y-ckt 06/93] qmi_wwan: add Sierra Wireless EM74xx device ID Kamal Mostafa <kamal@canonical.com> - 2016-04-26 20:50 +0200
[PATCH 4.2.y-ckt 14/93] farsync: fix off-by-one bug in fst_add_one Kamal Mostafa <kamal@canonical.com> - 2016-04-26 20:50 +0200
[PATCH 4.2.y-ckt 18/93] qmi_wwan: add "D-Link DWM-221 B1" device id Kamal Mostafa <kamal@canonical.com> - 2016-04-26 20:50 +0200
[PATCH 4.2.y-ckt 03/93] net: jme: fix suspend/resume on JMC260 Kamal Mostafa <kamal@canonical.com> - 2016-04-26 20:50 +0200
[PATCH 4.2.y-ckt 25/93] HID: usbhid: fix inconsistent reset/resume/reset-resume behavior Kamal Mostafa <kamal@canonical.com> - 2016-04-26 20:50 +0200
[PATCH 4.2.y-ckt 16/93] bonding: fix bond_get_stats() Kamal Mostafa <kamal@canonical.com> - 2016-04-26 20:50 +0200
[PATCH 4.2.y-ckt 09/93] net: validate variable length ll headers Kamal Mostafa <kamal@canonical.com> - 2016-04-26 20:50 +0200
[PATCH 4.2.y-ckt 02/93] tunnel: Clear IPCB(skb)->opt before dst_link_failure called Kamal Mostafa <kamal@canonical.com> - 2016-04-26 20:50 +0200
[PATCH 4.2.y-ckt 05/93] sctp: lack the check for ports in sctp_v6_cmp_addr Kamal Mostafa <kamal@canonical.com> - 2016-04-26 20:50 +0200
[PATCH 4.2.y-ckt 22/93] ipv6: l2tp: fix a potential issue in l2tp_ip6_recv Kamal Mostafa <kamal@canonical.com> - 2016-04-26 20:50 +0200
[PATCH 4.2.y-ckt 24/93] iwlwifi: pcie: lower the debug level for RSA semaphore access Kamal Mostafa <kamal@canonical.com> - 2016-04-26 20:50 +0200
[PATCH 4.2.y-ckt 10/93] ax25: add link layer header validation function Kamal Mostafa <kamal@canonical.com> - 2016-04-26 20:50 +0200
[PATCH 4.2.y-ckt 04/93] net: qca_spi: clear IFF_TX_SKB_SHARING Kamal Mostafa <kamal@canonical.com> - 2016-04-26 20:50 +0200
[PATCH 4.2.y-ckt 20/93] tun, bpf: fix suspicious RCU usage in tun_{attach, detach}_filter Kamal Mostafa <kamal@canonical.com> - 2016-04-26 20:50 +0200
[PATCH 4.2.y-ckt 21/93] ipv4: l2tp: fix a potential issue in l2tp_ip_recv Kamal Mostafa <kamal@canonical.com> - 2016-04-26 20:50 +0200
csiph-web