Unverified Commit b2140a04 authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!10121 usb: f_fs: Fix use-after-free for epfile 

Merge Pull Request from: @ci-robot 
 
PR sync from: Long Li <leo.lilong@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/O72CBUWM4PSH6NRXFIAXMCG4BBRCC5FB/ 
 
https://gitee.com/src-openeuler/kernel/issues/IADGRE 
 
Link:https://gitee.com/openeuler/kernel/pulls/10121

 

Reviewed-by: default avatarLiu YongQiang <liuyongqiang13@huawei.com>
Signed-off-by: default avatarZhang Changzhong <zhangchangzhong@huawei.com>
parents 8a6990b3 d93e2316

drivers/usb/gadget/function/f_fs.c

+42 −14
Original line number Diff line number Diff line
@@ -1640,16 +1640,24 @@ static void ffs_data_put(struct ffs_data *ffs) 


static void ffs_data_closed(struct ffs_data *ffs)

{

	struct ffs_epfile *epfiles;

	unsigned long flags;



	ENTER();



	if (atomic_dec_and_test(&ffs->opened)) {

		if (ffs->no_disconnect) {

			ffs->state = FFS_DEACTIVATED;

			if (ffs->epfiles) {

				ffs_epfiles_destroy(ffs->epfiles,

						   ffs->eps_count);

			spin_lock_irqsave(&ffs->eps_lock, flags);

			epfiles = ffs->epfiles;

			ffs->epfiles = NULL;

			}

			spin_unlock_irqrestore(&ffs->eps_lock,

							flags);



			if (epfiles)

				ffs_epfiles_destroy(epfiles,

						 ffs->eps_count);



			if (ffs->setup_state == FFS_SETUP_PENDING)

				__ffs_ep0_stall(ffs);

		} else {
@@ -1696,14 +1704,27 @@ static struct ffs_data *ffs_data_new(const char *dev_name) 


static void ffs_data_clear(struct ffs_data *ffs)

{

	struct ffs_epfile *epfiles;

	unsigned long flags;



	ENTER();



	ffs_closed(ffs);



	BUG_ON(ffs->gadget);



	if (ffs->epfiles) {

		ffs_epfiles_destroy(ffs->epfiles, ffs->eps_count);

	spin_lock_irqsave(&ffs->eps_lock, flags);

	epfiles = ffs->epfiles;

	ffs->epfiles = NULL;

	spin_unlock_irqrestore(&ffs->eps_lock, flags);



	/*

	 * potential race possible between ffs_func_eps_disable

	 * & ffs_epfile_release therefore maintaining a local

	 * copy of epfile will save us from use-after-free.

	 */

	if (epfiles) {

		ffs_epfiles_destroy(epfiles, ffs->eps_count);

		ffs->epfiles = NULL;

	}
@@ -1847,12 +1868,15 @@ static void ffs_epfiles_destroy(struct ffs_epfile *epfiles, unsigned count) 


static void ffs_func_eps_disable(struct ffs_function *func)

{

	struct ffs_ep *ep         = func->eps;

	struct ffs_epfile *epfile = func->ffs->epfiles;

	unsigned count            = func->ffs->eps_count;

	struct ffs_ep *ep;

	struct ffs_epfile *epfile;

	unsigned short count;

	unsigned long flags;



	spin_lock_irqsave(&func->ffs->eps_lock, flags);

	count = func->ffs->eps_count;

	epfile = func->ffs->epfiles;

	ep = func->eps;

	while (count--) {

		/* pending requests get nuked */

		if (likely(ep->ep))
@@ -1870,14 +1894,18 @@ static void ffs_func_eps_disable(struct ffs_function *func) 


static int ffs_func_eps_enable(struct ffs_function *func)

{

	struct ffs_data *ffs      = func->ffs;

	struct ffs_ep *ep         = func->eps;

	struct ffs_epfile *epfile = ffs->epfiles;

	unsigned count            = ffs->eps_count;

	struct ffs_data *ffs;

	struct ffs_ep *ep;

	struct ffs_epfile *epfile;

	unsigned short count;

	unsigned long flags;

	int ret = 0;



	spin_lock_irqsave(&func->ffs->eps_lock, flags);

	ffs = func->ffs;

	ep = func->eps;

	epfile = ffs->epfiles;

	count = ffs->eps_count;

	while(count--) {

		ep->ep->driver_data = ep;