github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-05-27 00:22:00 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

usb: gadget: f_fs: Fix ioctl error handling

Browse Source 
When ffs_epfile_ioctl handles FUNCTIONFS_DMABUF_* ioctls, it's currently
falling through when copy_from_user fails.

However, this fallthrough isn't being checked properly, so the handler
continues executing further than it should. It then tries the secondary
dispatch where it ultimately gives up and returns -ENOTTY.

The end result is invalid ioctl invocations will yield a -ENOTTY rather
than an -EFAULT.

It's a common pattern elsewhere in the kernel code to directly return
-EFAULT when copy_from_user fails. So we update ffs_epfile_ioctl to do
the same and fix this issue.

Signed-off-by: Sam Day <me@samcday.com>
Link: https://patch.msgid.link/20260108-ffs-dmabuf-ioctl-fix-v1-1-e51633891a81@samcday.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Sam Day 2026-01-08 08:30:20 +10:00 committed by Greg Kroah-Hartman
parent da0faa257f
commit 8e4c1d0618
1 changed files with 6 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
drivers/usb/gadget/function/f_fs.c
View File

@ -1748,10 +1748,8 @@ static long ffs_epfile_ioctl(struct file *file, unsigned code,
{
int fd;
if (copy_from_user(&fd, (void __user *)value, sizeof(fd))) {
ret = -EFAULT;
break;
}
if (copy_from_user(&fd, (void __user *)value, sizeof(fd)))
return -EFAULT;
return ffs_dmabuf_attach(file, fd);
}
@ -1759,10 +1757,8 @@ static long ffs_epfile_ioctl(struct file *file, unsigned code,
{
int fd;
if (copy_from_user(&fd, (void __user *)value, sizeof(fd))) {
ret = -EFAULT;
break;
}
if (copy_from_user(&fd, (void __user *)value, sizeof(fd)))
return -EFAULT;
return ffs_dmabuf_detach(file, fd);
}
@ -1770,10 +1766,8 @@ static long ffs_epfile_ioctl(struct file *file, unsigned code,
{
struct usb_ffs_dmabuf_transfer_req req;
if (copy_from_user(&req, (void __user *)value, sizeof(req))) {
ret = -EFAULT;
break;
}
if (copy_from_user(&req, (void __user *)value, sizeof(req)))
return -EFAULT;
return ffs_dmabuf_transfer(file, &req);
}