linux/drivers/usb
Vamsi Krishna Samavedam a4b98a7512 usb: gadget: f_fs: Use local copy of descriptors for userspace copy
The function may be unbound causing the ffs_ep and its descriptors
to be freed while userspace is in the middle of an ioctl requesting
the same descriptors. Avoid dangling pointer reference by first
making a local copy of desctiptors before releasing the spinlock.

Fixes: c559a35341 ("usb: gadget: f_fs: add ioctl returning ep descriptor")
Reviewed-by: Peter Chen <peter.chen@nxp.com>
Signed-off-by: Vamsi Krishna Samavedam <vskrishn@codeaurora.org>
Signed-off-by: Jack Pham <jackp@codeaurora.org>
Cc: stable <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20201130203453.28154-1-jackp@codeaurora.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-12-04 16:09:10 +01:00
..
atm usb: atm: don't use snprintf() for sysfs attrs 2020-08-25 19:11:18 +02:00
c67x00 Linux 5.9-rc3 2020-08-31 07:11:45 +02:00
cdns3 usb: cdns3: core: fix goto label for error path 2020-11-30 13:48:32 +08:00
chipidea usb: chipidea: ci_hdrc_imx: restore pinctrl 2020-09-03 16:32:07 +08:00
class usb: cdc-acm: Add DISABLE_ECHO for Renesas USB Download mode 2020-11-13 15:26:49 +01:00
common usb: common: usb-conn-gpio: Print error on failure to get VBUS 2020-08-18 12:13:44 +02:00
core USB: core: Change %pK for __user pointers to %px 2020-11-20 16:36:31 +01:00
dwc2 usb: dwc2: Avoid leaving the error_debugfs label unused 2020-10-27 11:33:53 +02:00
dwc3 USB: fixes for v5.10-rc2 2020-11-02 13:36:11 +01:00
early usb: early: ehci-dbgp: convert to readl_poll_timeout_atomic() 2020-09-25 16:29:09 +02:00
gadget usb: gadget: f_fs: Use local copy of descriptors for userspace copy 2020-12-04 16:09:10 +01:00
host usb: ohci-omap: Fix descriptor conversion 2020-12-04 16:03:52 +01:00
image USB: microtek: use set_host_byte() 2020-09-16 12:42:10 +02:00
isp1760 usb: isp1760-hcd: convert to readl_poll_timeout_atomic() 2020-09-25 16:30:05 +02:00
misc USB: apple-mfi-fastcharge: fix reference leak in apple_mfi_fc_set_property 2020-11-06 12:06:58 +01:00
mon USB: mon: Use scnprintf() for avoiding potential buffer overflow 2020-03-12 09:49:28 +01:00
mtu3 usb: mtu3: fix panic in mtu3_gadget_stop() 2020-11-06 12:06:57 +01:00
musb Revert "usb: musb: convert to devm_platform_ioremap_resource_byname" 2020-11-13 14:30:23 +01:00
phy usb: phy: phy-ab8500-usb: fix spello of "function" 2020-10-02 09:57:41 +03:00
renesas_usbhs usb: Use fallthrough pseudo-keyword 2020-07-10 08:55:17 +02:00
roles device connection: Remove struct device_connection 2020-09-07 11:14:09 +02:00
serial USB: serial: kl5kusb105: fix memleak on open 2020-12-04 12:02:57 +01:00
storage Revert "usb-storage: fix sdev->host->dma_dev" 2020-12-04 16:01:23 +01:00
typec usb: typec: stusb160x: fix power-opmode property with typec-power-opmode 2020-11-27 14:44:26 +01:00
usbip usbip: vhci_hcd: fix calling usb_hcd_giveback_urb() with irqs enabled 2020-10-07 09:25:48 +02:00
Kconfig treewide: replace '---help---' in Kconfig files with 'help' 2020-06-14 01:57:21 +09:00
Makefile
usb-skeleton.c