1. 09 Nov, 2017 3 commits
    • Andrew Gabbasov's avatar
      usb: gadget: f_fs: Fix use-after-free in ffs_free_inst · cdafb6d8
      Andrew Gabbasov authored
      KASAN enabled configuration reports an error
      
      BUG: KASAN: use-after-free in ffs_free_inst+... [usb_f_fs] at addr ...
      Write of size 8 by task ...
      
      This is observed after "ffs-test" is run and interrupted. If after that
      functionfs is unmounted and g_ffs module is unloaded, that use-after-free
      occurs during g_ffs module removal.
      
      Although the report indicates ffs_free_inst() function, the actual
      use-after-free condition occurs in _ffs_free_dev() function, which
      is probably inlined into ffs_free_inst().
      
      This happens due to keeping the ffs_data reference in device structure
      during functionfs unmounting, while ffs_data itself is freed as no longer
      needed. The fix is to clear that reference in ffs_closed() function,
      which is a counterpart of ffs_ready(), where the reference is stored.
      
      Fixes: 3262ad82 ("usb: gadget: f_fs: Stop ffs_closed NULL pointer dereference")
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarAndrew Gabbasov <andrew_gabbasov@mentor.com>
      Acked-by: default avatarFelipe Balbi <felipe.balbi@linux.intel.com>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      cdafb6d8
    • Alan Stern's avatar
      USB: usbfs: compute urb->actual_length for isochronous · 2ef47001
      Alan Stern authored
      The USB kerneldoc says that the actual_length field "is read in
      non-iso completion functions", but the usbfs driver uses it for all
      URB types in processcompl().  Since not all of the host controller
      drivers set actual_length for isochronous URBs, programs using usbfs
      with some host controllers don't work properly.  For example, Minas
      reports that a USB camera controlled by libusb doesn't work properly
      with a dwc2 controller.
      
      It doesn't seem worthwhile to change the HCDs and the documentation,
      since the in-kernel USB class drivers evidently don't rely on
      actual_length for isochronous transfers.  The easiest solution is for
      usbfs to calculate the actual_length value for itself, by adding up
      the lengths of the individual packets in an isochronous transfer.
      Signed-off-by: default avatarAlan Stern <stern@rowland.harvard.edu>
      CC: Minas Harutyunyan <Minas.Harutyunyan@synopsys.com>
      Reported-and-tested-by: default avatarwlf <wulf@rock-chips.com>
      CC: <stable@vger.kernel.org>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      2ef47001
    • Felipe Balbi's avatar
      usb: core: message: remember to reset 'ret' to 0 when necessary · d656fa32
      Felipe Balbi authored
      usb_control_msg() will return the amount of bytes transferred, if that
      amount matches what we wanted to transfer, we need to reset 'ret' to 0
      from usb_get_status().
      
      Fixes: 2e43f0fe ("usb: core: add a 'type' parameter to usb_get_status()")
      Reported-by: default avatarTony Lindgren <tony@atomide.com>
      Signed-off-by: default avatarFelipe Balbi <felipe.balbi@linux.intel.com>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      d656fa32
  2. 07 Nov, 2017 37 commits