usb: gadget: f_fs: Prevent race during ffs_ep0_queue_wait
While performing fast composition switch, there is a possibility that the process of ffs_ep0_write/ffs_ep0_read get into a race condition due to ep0req being freed up from functionfs_unbind. Consider the scenario that the ffs_ep0_write calls the ffs_ep0_queue_wait by taking a lock &ffs->ev.waitq.lock. However, the functionfs_unbind isn't bounded so it can go ahead and mark the ep0req to NULL, and since there is no NULL check in ffs_ep0_queue_wait we will end up in use-after-free. Fix this by making a serialized execution between the two functions using a mutex_lock(ffs->mutex). Fixes: ddf8abd2 ("USB: f_fs: the FunctionFS driver") Signed-off-by:Udipto Goswami <quic_ugoswami@quicinc.com> Tested-by:
Krishna Kurapati <quic_kriskura@quicinc.com> Link: https://lore.kernel.org/r/20221215052906.8993-2-quic_ugoswami@quicinc.com Signed-off-by:
Greg Kroah-Hartman <gregkh@linuxfoundation.org>
parent
cde37881
-
mentioned in commit facf353c
-
mentioned in commit e9036e95
-
mentioned in commit a8d40942
-
mentioned in commit 921deb9d
-
mentioned in commit 9ba1188a
-
mentioned in commit 3b1534f5
-
mentioned in commit 434a36ed
-
mentioned in commit 4023c364
-
mentioned in commit 554177f3
-
mentioned in commit 3bd7816c
-
mentioned in commit 9a95fba9
-
mentioned in commit a4f88cb0
-
mentioned in commit 599e1920
-
mentioned in commit d5f18388
-
mentioned in commit 704842c9
-
mentioned in commit 7d4d05d3
Please register or sign in to comment