diff options
| author | Al Viro <viro@zeniv.linux.org.uk> | 2015-02-06 10:07:45 +0300 |
|---|---|---|
| committer | Ben Hutchings <ben@decadent.org.uk> | 2015-05-10 01:16:24 +0300 |
| commit | f872bbe889c7c78edb222854217b02aaf24b4254 (patch) | |
| tree | b8764ccb733822b9b2fcc02260ed75158b95868b /drivers/usb/gadget/inode.c | |
| parent | 7e17502f742a8e8229ce706127ba2a52fa086ed3 (diff) | |
| download | linux-f872bbe889c7c78edb222854217b02aaf24b4254.tar.xz | |
gadgetfs: use-after-free in ->aio_read()
commit f01d35a15fa04162a58b95970fc01fa70ec9dacd upstream.
AIO_PREAD requests call ->aio_read() with iovec on caller's stack, so if
we are going to access it asynchronously, we'd better get ourselves
a copy - the one on kernel stack of aio_run_iocb() won't be there
anymore. function/f_fs.c take care of doing that, legacy/inode.c
doesn't...
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
[bwh: Backported to 3.2:
- Adjust filename, context
- Add kfree(priv->iv) to one additional failure path]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Diffstat (limited to 'drivers/usb/gadget/inode.c')
| -rw-r--r-- | drivers/usb/gadget/inode.c | 14 |
1 files changed, 12 insertions, 2 deletions
diff --git a/drivers/usb/gadget/inode.c b/drivers/usb/gadget/inode.c index 71385402f4c1..d00b3e3a6cfe 100644 --- a/drivers/usb/gadget/inode.c +++ b/drivers/usb/gadget/inode.c @@ -570,6 +570,7 @@ static ssize_t ep_aio_read_retry(struct kiocb *iocb) break; } kfree(priv->buf); + kfree(priv->iv); kfree(priv); return len; } @@ -591,6 +592,7 @@ static void ep_aio_complete(struct usb_ep *ep, struct usb_request *req) */ if (priv->iv == NULL || unlikely(req->actual == 0)) { kfree(req->buf); + kfree(priv->iv); kfree(priv); iocb->private = NULL; /* aio_complete() reports bytes-transferred _and_ faults */ @@ -626,7 +628,7 @@ ep_aio_rwtail( struct usb_request *req; ssize_t value; - priv = kmalloc(sizeof *priv, GFP_KERNEL); + priv = kzalloc(sizeof *priv, GFP_KERNEL); if (!priv) { value = -ENOMEM; fail: @@ -634,7 +636,14 @@ fail: return value; } iocb->private = priv; - priv->iv = iv; + if (iv) { + priv->iv = kmemdup(iv, nr_segs * sizeof(struct iovec), + GFP_KERNEL); + if (!priv->iv) { + kfree(priv); + goto fail; + } + } priv->nr_segs = nr_segs; value = get_ready_ep(iocb->ki_filp->f_flags, epdata); @@ -672,6 +681,7 @@ fail: mutex_unlock(&epdata->lock); if (unlikely(value)) { + kfree(priv->iv); kfree(priv); put_ep(epdata); } else |