| author | Xiaoliang Wang <xiaoliang.wang@amlogic.com> | 2018-10-18 11:28:14 (GMT) |
|---|---|---|
| committer | Gerrit Code Review <gituser@droid04> | 2018-10-18 11:28:14 (GMT) |
| commit | fb2d66885130e7af3dafdfa1fd433c7709f07573 (patch) | |
| tree | 43340c065971cc738dc5a4b7d6f3b6da7032f31e | |
| parent | 5a3e64d40eac3f2e49a3e342c9432a0c0524601a (diff) | |
| parent | e5c766a6b26760cab870e18530d899af034b9d36 (diff) | |
| download | common-fb2d66885130e7af3dafdfa1fd433c7709f07573.zip common-fb2d66885130e7af3dafdfa1fd433c7709f07573.tar.gz common-fb2d66885130e7af3dafdfa1fd433c7709f07573.tar.bz2 | |
Merge "usb: use-after-free in ffs_epfile_io+0x1c0/0x9b8" into p-amlogic
| -rw-r--r-- | drivers/usb/gadget/function/f_fs.c | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c index ca41f19..055c03a 100644 --- a/drivers/usb/gadget/function/f_fs.c +++ b/drivers/usb/gadget/function/f_fs.c @@ -952,6 +952,7 @@ static ssize_t ffs_epfile_io(struct file *file, struct ffs_io_data *io_data) #ifdef CONFIG_AMLOGIC_USB struct ffs_ep *ep = epfile->ep; struct ffs_data_buffer *buffer = NULL; + int data_flag = -1; #else struct ffs_ep *ep; #endif @@ -1036,6 +1037,7 @@ static ssize_t ffs_epfile_io(struct file *file, struct ffs_io_data *io_data) if (io_data->aio) { spin_unlock_irq(&epfile->ffs->eps_lock); data = kmalloc(data_len, GFP_KERNEL); + data_flag = 1; if (unlikely(!data)) { ret = -ENOMEM; goto error_mutex; @@ -1060,6 +1062,7 @@ static ssize_t ffs_epfile_io(struct file *file, struct ffs_io_data *io_data) * been released in kill_sb. */ buffer = assign_ffs_buffer(epfile->ffs); + data_flag = -1; if (unlikely(!buffer)) { ret = -ENOMEM; spin_unlock_irq(&epfile->ffs->eps_lock); @@ -1174,7 +1177,7 @@ error_mutex: mutex_unlock(&epfile->mutex); error: #ifdef CONFIG_AMLOGIC_USB - if (io_data->aio) { + if (data_flag > 0) { kfree(data); data = NULL; } else { |