diff options
| author | Udipto Goswami <quic_ugoswami@quicinc.com> | 2022-12-15 08:29:05 +0300 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2023-01-17 19:07:06 +0300 |
| commit | 6a19da111057f69214b97c62fb0ac59023970850 (patch) | |
| tree | 63c86f39f42f34d52cd349bb6f4dd601f7e79dd0 /arch/m68k/mvme147 | |
| parent | cde37881e2e14590675d0acdfbad408300d9ca95 (diff) | |
| download | linux-6a19da111057f69214b97c62fb0ac59023970850.tar.xz | |
usb: gadget: f_fs: Prevent race during ffs_ep0_queue_wait
While performing fast composition switch, there is a possibility that the
process of ffs_ep0_write/ffs_ep0_read get into a race condition
due to ep0req being freed up from functionfs_unbind.
Consider the scenario that the ffs_ep0_write calls the ffs_ep0_queue_wait
by taking a lock &ffs->ev.waitq.lock. However, the functionfs_unbind isn't
bounded so it can go ahead and mark the ep0req to NULL, and since there
is no NULL check in ffs_ep0_queue_wait we will end up in use-after-free.
Fix this by making a serialized execution between the two functions using
a mutex_lock(ffs->mutex).
Fixes: ddf8abd25994 ("USB: f_fs: the FunctionFS driver")
Signed-off-by: Udipto Goswami <quic_ugoswami@quicinc.com>
Tested-by: Krishna Kurapati <quic_kriskura@quicinc.com>
Link: https://lore.kernel.org/r/20221215052906.8993-2-quic_ugoswami@quicinc.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'arch/m68k/mvme147')
0 files changed, 0 insertions, 0 deletions