malhuda/msm-4.14
1
0
Fork 0
mirror of https://github.com/rd-stuffs/msm-4.14.git synced 2025-02-20 11:45:48 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

usb: gadget: Prevent use after free in qdss connect & close

Browse Source 
Dwc3 gadget controller driver can still access usb_request
after dequeue() returns due to async cancellation.
Hence usb_request shouldn't be freed after calling
usb_ep_dequeue() which can otherwise cause use after free.

Fix this by allocating & de-allocating from bind and unbind
instead of data_connection & close.

Currently qdss->gadget is initialised from qdss_set_alt() only,
but alloc_sps_req() uses qdss->gadget which gets called from
qdss_bind(). A potential null pointer dereference can occur
if qdss_bind() gets called before qdss_set_alt(). This is avoided
by duplicating qdss->gadget initialisation from qdss_bind().

Change-Id: I8155ecbebcf762fc87c17841c72c53c6dca2e4a9
Signed-off-by: Udipto Goswami <ugoswami@codeaurora.org>
This commit is contained in:
Udipto Goswami 2020-02-13 12:26:51 +05:30 committed by Prashanth K
parent 34e0fe56b5
commit 49101f4b48
3 changed files with 36 additions and 14 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

39
drivers/usb/gadget/function/f_qdss.c
View File

@ -413,6 +413,7 @@ static int qdss_bind(struct usb_configuration *c, struct usb_function *f)
struct usb_ep *ep;
int iface, id, ret;
qdss->gadget = gadget;
qdss_log("%s: channel name = %s\n", __func__, qdss->ch.name);
/* Allocate data I/F */
@ -459,7 +460,7 @@ static int qdss_bind(struct usb_configuration *c, struct usb_function *f)
&qdss_data_ep_comp_desc);
if (!ep) {
pr_err("%s: ep_autoconfig error\n", __func__);
goto fail;
goto clear_ep;
}
qdss->port.data = ep;
ep->driver_data = qdss;
@ -469,8 +470,9 @@ static int qdss_bind(struct usb_configuration *c, struct usb_function *f)
&qdss_ctrl_in_ep_comp_desc);
if (!ep) {
pr_err("%s: ep_autoconfig error\n", __func__);
goto fail;
goto clear_ep;
}
qdss->port.ctrl_in = ep;
ep->driver_data = qdss;
@ -478,12 +480,21 @@ static int qdss_bind(struct usb_configuration *c, struct usb_function *f)
&qdss_ctrl_out_ep_comp_desc);
if (!ep) {
pr_err("%s: ep_autoconfig error\n", __func__);
goto fail;
goto clear_ep;
}
qdss->port.ctrl_out = ep;
ep->driver_data = qdss;
}
if (!strcmp(qdss->ch.name, USB_QDSS_CH_MSM)) {
ret = alloc_sps_req(qdss->port.data);
if (ret) {
pr_err("%s: alloc_sps_req error (%d)\n",
__func__, ret);
goto clear_ep;
}
}
/*update fs descriptors*/
qdss_fs_data_desc.bEndpointAddress =
qdss_ss_data_desc.bEndpointAddress;
@ -516,9 +527,18 @@ static int qdss_bind(struct usb_configuration *c, struct usb_function *f)
goto fail;
return 0;
fail:
/* check if usb_request allocated */
if (qdss->endless_req) {
usb_ep_free_request(qdss->port.data,
qdss->endless_req);
qdss->endless_req = NULL;
}
clear_ep:
clear_eps(f);
clear_desc(gadget, f);
return -ENOTSUPP;
}
@ -532,6 +552,12 @@ static void qdss_unbind(struct usb_configuration *c, struct usb_function *f)
flush_workqueue(qdss->wq);
if (qdss->endless_req) {
usb_ep_free_request(qdss->port.data,
qdss->endless_req);
qdss->endless_req = NULL;
}
/* Reset string ids */
qdss_string_defs[QDSS_DATA_IDX].id = 0;
qdss_string_defs[QDSS_CTRL_IDX].id = 0;
@ -1020,11 +1046,6 @@ void usb_qdss_close(struct usb_qdss_ch *ch)
spin_unlock_irqrestore(&qdss_lock, flags);
usb_ep_dequeue(qdss->port.data, qdss->endless_req);
spin_lock_irqsave(&qdss_lock, flags);
if (qdss->endless_req) {
usb_ep_free_request(qdss->port.data,
qdss->endless_req);
qdss->endless_req = NULL;
}
}
gadget = qdss->gadget;
ch->app_conn = 0;

4
drivers/usb/gadget/function/f_qdss.h
View File

@ -1,5 +1,6 @@
/* SPDX-License-Identifier: GPL-2.0-only */
/*
* Copyright (c) 2012-2017,2021 The Linux Foundation. All rights reserved.
* Copyright (c) 2012-2020, The Linux Foundation. All rights reserved.
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License version 2 and
@ -95,4 +96,5 @@ struct usb_qdss_opts {
int uninit_data(struct usb_ep *ep);
int set_qdss_data_connection(struct f_qdss *qdss, int enable);
int alloc_sps_req(struct usb_ep *data_ep);
#endif

7
drivers/usb/gadget/function/u_qdss.c
View File

@ -17,7 +17,7 @@
#include <linux/dma-mapping.h>
#include "f_qdss.h"
static int alloc_sps_req(struct usb_ep *data_ep)
int alloc_sps_req(struct usb_ep *data_ep)
{
struct usb_request *req = NULL;
struct f_qdss *qdss = data_ep->driver_data;
@ -34,8 +34,7 @@ static int alloc_sps_req(struct usb_ep *data_ep)
if (!gadget->is_chipidea) {
req->length = 32*1024;
sps_params = MSM_SPS_MODE | MSM_DISABLE_WB |
qdss->bam_info.usb_bam_pipe_idx;
sps_params = MSM_SPS_MODE | MSM_DISABLE_WB;
} else {
/* non DWC3 BAM requires req->length to be 0 */
req->length = 0;
@ -115,7 +114,7 @@ int set_qdss_data_connection(struct f_qdss *qdss, int enable)
&bam_info.usb_bam_pipe_idx,
NULL, bam_info.data_fifo, NULL);
alloc_sps_req(qdss->port.data);
qdss->endless_req->udc_priv |= qdss->bam_info.usb_bam_pipe_idx;
if (!gadget->is_chipidea)
msm_data_fifo_config(qdss->port.data,
bam_info.data_fifo->iova,