| author | Xiaoliang Wang <xiaoliang.wang@amlogic.com> | 2018-10-23 08:59:51 (GMT) |
|---|---|---|
| committer | Xiaoliang Wang <xiaoliang.wang@amlogic.com> | 2018-10-23 08:59:51 (GMT) |
| commit | cf47833684ad8a7d7022e82a4ef6fa567d91e82b (patch) | |
| tree | bf47379a9f6fdfe3ecab3f8ad1e05b498cdb50e7 | |
| parent | db8c8b191c9f41d4863439f6d43b90a65e0c5425 (diff) | |
| download | common-cf47833684ad8a7d7022e82a4ef6fa567d91e82b.zip common-cf47833684ad8a7d7022e82a4ef6fa567d91e82b.tar.gz common-cf47833684ad8a7d7022e82a4ef6fa567d91e82b.tar.bz2 | |
Revert "Revert "usb: use-after-free in ffs_epfile_io+0x1c0/0x9b8""
This reverts commit db8c8b191c9f41d4863439f6d43b90a65e0c5425.
Change-Id: I194afb5e90c744566f9574cfd56758d7c028b1c7
| -rw-r--r-- | drivers/usb/gadget/function/f_fs.c | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c index ca41f19..055c03a 100644 --- a/drivers/usb/gadget/function/f_fs.c +++ b/drivers/usb/gadget/function/f_fs.c @@ -952,6 +952,7 @@ static ssize_t ffs_epfile_io(struct file *file, struct ffs_io_data *io_data) #ifdef CONFIG_AMLOGIC_USB struct ffs_ep *ep = epfile->ep; struct ffs_data_buffer *buffer = NULL; + int data_flag = -1; #else struct ffs_ep *ep; #endif @@ -1036,6 +1037,7 @@ static ssize_t ffs_epfile_io(struct file *file, struct ffs_io_data *io_data) if (io_data->aio) { spin_unlock_irq(&epfile->ffs->eps_lock); data = kmalloc(data_len, GFP_KERNEL); + data_flag = 1; if (unlikely(!data)) { ret = -ENOMEM; goto error_mutex; @@ -1060,6 +1062,7 @@ static ssize_t ffs_epfile_io(struct file *file, struct ffs_io_data *io_data) * been released in kill_sb. */ buffer = assign_ffs_buffer(epfile->ffs); + data_flag = -1; if (unlikely(!buffer)) { ret = -ENOMEM; spin_unlock_irq(&epfile->ffs->eps_lock); @@ -1174,7 +1177,7 @@ error_mutex: mutex_unlock(&epfile->mutex); error: #ifdef CONFIG_AMLOGIC_USB - if (io_data->aio) { + if (data_flag > 0) { kfree(data); data = NULL; } else { |