From: Sriharsha Allenki Date: Thu, 26 Mar 2020 11:56:20 +0000 (+0530) Subject: usb: gadget: f_fs: Fix use after free issue as part of queue failure X-Git-Tag: Ubuntu-5.4.0-30.34~239 X-Git-Url: https://git.proxmox.com/?a=commitdiff_plain;h=83941a684c92b1559c003756badb0de1c76de98e;p=mirror_ubuntu-focal-kernel.git usb: gadget: f_fs: Fix use after free issue as part of queue failure BugLink: https://bugs.launchpad.net/bugs/1873481 commit f63ec55ff904b2f2e126884fcad93175f16ab4bb upstream. In AIO case, the request is freed up if ep_queue fails. However, io_data->req still has the reference to this freed request. In the case of this failure if there is aio_cancel call on this io_data it will lead to an invalid dequeue operation and a potential use after free issue. Fix this by setting the io_data->req to NULL when the request is freed as part of queue failure. Fixes: 2e4c7553cd6f ("usb: gadget: f_fs: add aio support") Signed-off-by: Sriharsha Allenki CC: stable Reviewed-by: Peter Chen Link: https://lore.kernel.org/r/20200326115620.12571-1-sallenki@codeaurora.org Signed-off-by: Greg Kroah-Hartman Signed-off-by: Kamal Mostafa Signed-off-by: Kelsey Skunberg --- diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c index b8cdfa247629..320547dfb102 100644 --- a/drivers/usb/gadget/function/f_fs.c +++ b/drivers/usb/gadget/function/f_fs.c @@ -1120,6 +1120,7 @@ static ssize_t ffs_epfile_io(struct file *file, struct ffs_io_data *io_data) ret = usb_ep_queue(ep->ep, req, GFP_ATOMIC); if (unlikely(ret)) { + io_data->req = NULL; usb_ep_free_request(ep->ep, req); goto error_lock; }