leandrof/linux
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
aa65d11aa0
linux/drivers/usb/gadget/function
History
Krzysztof Opasiak aa65d11aa0 usb: gadget: f_hid: fix: Prevent accessing released memory 
When we unlock our spinlock to copy data to user we may get
disabled by USB host and free the whole list of completed out
requests including the one from which we are copying the data
to user memory.

To prevent from this let's remove our working element from
the list and place it back only if there is sth left when we
finish with it.

Fixes: 99c5150058 ("usb: gadget: hidg: register OUT INT endpoint for SET_REPORT")
Cc: stable@vger.kernel.org
Tested-by: David Lechner <david@lechnology.com>
Signed-off-by: Krzysztof Opasiak <k.opasiak@samsung.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
2017-01-24 11:04:17 +02:00
..
f_acm.c
f_ecm.c
f_eem.c usb: gadget: prevent potenial null pointer dereference on skb->len 2016-09-06 10:44:03 +03:00
f_fs.c usb: gadget: f_fs: Fix possibe deadlock 2017-01-02 10:55:28 +02:00
f_hid.c usb: gadget: f_hid: fix: Prevent accessing released memory 2017-01-24 11:04:17 +02:00
f_loopback.c usb: gadget: remove variable ret and remove unnecessary if statement 2016-09-09 13:38:37 +03:00
f_mass_storage.c usb: gadget: Add per-lun inquiry string 2016-08-25 12:13:13 +03:00
f_mass_storage.h usb: gadget: Add per-lun inquiry string 2016-08-25 12:13:13 +03:00
f_midi.c usb: gadget: remove useless parameter in alloc_ep_req() 2016-08-25 12:13:19 +03:00
f_ncm.c ktime: Cleanup ktime_set() usage 2016-12-25 17:21:22 +01:00
f_obex.c
f_phonet.c net: use core MTU range checking in misc drivers 2016-10-20 14:51:10 -04:00
f_printer.c usb: gadget: printer: Remove pnp_string static buffer 2017-01-24 11:04:08 +02:00
f_rndis.c usb: gadget: function: f_rndis: socket buffer may be NULL 2016-08-22 10:45:12 +03:00
f_serial.c
f_sourcesink.c usb: gadget: remove useless parameter in alloc_ep_req() 2016-08-25 12:13:19 +03:00
f_subset.c
f_tcm.c usb: gadget: Fix second argument of percpu_ida_alloc() 2016-12-09 10:20:08 -08:00
f_uac1.c
f_uac2.c usb: gadget: f_uac2: improve error handling 2017-01-24 11:04:11 +02:00
f_uvc.c usb: gadget: uvc: Add missing call for additional setup data 2016-08-31 10:06:04 +03:00
f_uvc.h
g_zero.h
Makefile
ndis.h
rndis.c usb: gadget: Fix checkpatch error for braces 2016-11-18 13:54:41 +02:00
rndis.h usb: gadget: Fix checkpatch error for braces 2016-11-18 13:54:41 +02:00
storage_common.c usb: gadget: Add per-lun inquiry string 2016-08-25 12:13:13 +03:00
storage_common.h usb: gadget: Add per-lun inquiry string 2016-08-25 12:13:13 +03:00
tcm.h
u_ecm.h
u_eem.h
u_ether_configfs.h usb: gadget: ether: Add \n to each attribute of ethernet functions 2017-01-24 11:04:07 +02:00
u_ether.c usb: gadget: ether: Add \n to each attribute of ethernet functions 2017-01-24 11:04:07 +02:00
u_ether.h usb: gadget: u_ether: add a flag to avoid skb_reserve() calling 2016-08-31 10:06:03 +03:00
u_fs.h
u_gether.h
u_hid.h
u_midi.h
u_ncm.h
u_phonet.h
u_printer.h usb: gadget: printer: Remove pnp_string static buffer 2017-01-24 11:04:08 +02:00
u_rndis.h
u_serial.c usb: gadget: serial: fix possible Oops caused by calling kthread_stop(NULL) 2016-11-18 13:55:19 +02:00
u_serial.h
u_tcm.h
u_uac1.c
u_uac1.h
u_uac2.h
u_uvc.h
uvc_configfs.c fs: configfs: don't return anything from drop_link 2016-12-01 10:50:49 +01:00
uvc_configfs.h
uvc_queue.c
uvc_queue.h
uvc_v4l2.c usb: gadget: Fix checkpatch error for braces 2016-11-18 13:54:41 +02:00
uvc_v4l2.h
uvc_video.c usb: gadget: composite: always set ep->mult to a sensible value 2016-10-31 11:15:33 +02:00
uvc_video.h
uvc.h usb: gadget: Fix checkpatch error for braces 2016-11-18 13:54:41 +02:00