Messages in this thread | | | Subject | Re: [patch -target tree] usb: gadget: f_tcm: use after free | From | Andrzej Pietrasiewicz <> | Date | Thu, 10 Mar 2016 09:34:50 +0100 |
| |
Hi Nicholas,
W dniu 10.03.2016 o 06:19, Nicholas A. Bellinger pisze: > Hi Andrzej, > > On Wed, 2016-03-09 at 13:53 +0100, Andrzej Pietrasiewicz wrote: >> Hi Nicholas, >>
<snip>
> > Applying the following patch to re-add the missing assingment > as a proper alloc_session callback. > > diff --git a/drivers/usb/gadget/function/f_tcm.c b/drivers/usb/gadget/function/f_tcm.c > index e352a31..348140c 100644 > --- a/drivers/usb/gadget/function/f_tcm.c > +++ b/drivers/usb/gadget/function/f_tcm.c > @@ -1570,6 +1570,16 @@ out: > return ret; > } > > +static int usbg_alloc_sess_cb(struct se_portal_group *se_tpg, > + struct se_session *se_sess, void *p) > +{ > + struct usbg_tpg *tpg = container_of(se_tpg, > + struct usbg_tpg, se_tpg); > + > + tpg->tpg_nexus = p; > + return 0; > +} > + > static int tcm_usbg_make_nexus(struct usbg_tpg *tpg, char *name) > { > struct tcm_usbg_nexus *tv_nexus; > @@ -1591,7 +1601,7 @@ static int tcm_usbg_make_nexus(struct usbg_tpg *tpg, char *name) > tv_nexus->tvn_se_sess = target_alloc_session(&tpg->se_tpg, 128, > sizeof(struct usbg_cmd), > TARGET_PROT_NORMAL, name, > - tv_nexus, NULL); > + tv_nexus, usbg_alloc_sess_cb); > if (IS_ERR(tv_nexus->tvn_se_sess)) { > #define MAKE_NEXUS_MSG "core_tpg_check_initiator_node_acl() failed for %s\n" > pr_debug(MAKE_NEXUS_MSG, name); >
<snip>
> > Mmmm, usbg_get_cmd() was missing an explicit memset() after tag lookup. > > How about the following..? > > diff --git a/drivers/usb/gadget/function/f_tcm.c b/drivers/usb/gadget/function/f_tcm.c > index e352a31..d4e8a91 100644 > --- a/drivers/usb/gadget/function/f_tcm.c > +++ b/drivers/usb/gadget/function/f_tcm.c > @@ -1078,6 +1078,7 @@ static struct usbg_cmd *usbg_get_cmd(struct f_uas *fu, > return ERR_PTR(-ENOMEM); > > cmd = &((struct usbg_cmd *)se_sess->sess_cmd_map)[tag]; > + memset(cmd, 0, sizeof(*cmd)); > cmd->se_cmd.map_tag = tag; > cmd->se_cmd.tag = cmd->tag = scsi_tag; > cmd->fu = fu; > > >
I tested it. Works for me.
AP
| |