A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-11 15:11:48 -04:00
Code Issues Projects Releases Packages Wiki Activity

usb: gadget: ffs: Use local copy of descriptors for userspace copy

Browse source 
USB cable can be disconnected (function disable) and function
descriptors can be freed while userspace daemon requesting for
descriptors copy to userspace. Avoid stale pointer copy by always
copying only local copy of desctiptors.

Change-Id: I16c01d22058e7148546f1ffbc5017520402eda97
Signed-off-by: Vamsi Krishna Samavedam <vskrishn@codeaurora.org>
This commit is contained in:
Vamsi Krishna Samavedam 2018-12-21 16:17:44 -08:00 • committed by Gerrit - the friendly Code Review server
commit 3a85476e48
1 changed files with 4 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

6
drivers/usb/gadget/function/f_fs.c
View file

@ -1324,7 +1324,7 @@ static long ffs_epfile_ioctl(struct file *file, unsigned code,
case FUNCTIONFS_ENDPOINT_DESC:
{
int desc_idx;
struct usb_endpoint_descriptor *desc;
struct usb_endpoint_descriptor desc1, *desc;
switch (epfile->ffs->gadget->speed) {
case USB_SPEED_SUPER:
@ -1336,10 +1336,12 @@ static long ffs_epfile_ioctl(struct file *file, unsigned code,
default:
desc_idx = 0;
}
desc = epfile->ep->descs[desc_idx];
memcpy(&desc1, desc, desc->bLength);
spin_unlock_irq(&epfile->ffs->eps_lock);
ret = copy_to_user((void __user *)value, desc, desc->bLength);
ret = copy_to_user((void __user *)value, &desc1, desc1.bLength);
if (ret)
ret = -EFAULT;
return ret;