Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
From:   "Yang, Fei" <fei.yang@intel.com>
To:     "mgautam@codeaurora.org" <mgautam@codeaurora.org>
CC:     "balbi@kernel.org" <balbi@kernel.org>,
        "gregkh@linuxfoundation.org" <gregkh@linuxfoundation.org>,
        "zhangjerry@google.com" <zhangjerry@google.com>,
        "andrzej.p@collabora.com" <andrzej.p@collabora.com>,
        "plr.vincent@gmail.com" <plr.vincent@gmail.com>,
        "Shen, JingX" <jingx.shen@intel.com>,
        "john.stultz@linaro.org" <john.stultz@linaro.org>,
        "linux-usb@vger.kernel.org" <linux-usb@vger.kernel.org>,
        "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
        "linux-usb-owner@vger.kernel.org" <linux-usb-owner@vger.kernel.org>
Subject: RE: [PATCH] usb: gadget: f_fs: don't free buffer prematurely
Thread-Topic: [PATCH] usb: gadget: f_fs: don't free buffer prematurely
Thread-Index: AQHU3qsSI6LKjKQGEU+fpZKqH+DdLqYUUrWA//+twSA=
Date:   Wed, 20 Mar 2019 05:38:38 +0000
Message-ID: <02E7334B1630744CBDC55DA8586225837F7FB244@ORSMSX102.amr.corp.intel.com>
References: <1553037915-85931-1-git-send-email-fei.yang@intel.com>
 <f382765c6d30972ab84224a1b3982f62@codeaurora.org>
In-Reply-To: <f382765c6d30972ab84224a1b3982f62@codeaurora.org>
Accept-Language: en-US
Content-Language: en-US
dlp-product: dlpe-windows
dlp-version: 11.0.400.15
dlp-reaction: no-action
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 8BIT
MIME-Version: 1.0
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

>> From: Fei Yang <fei.yang@intel.com>
>> 
>> The following kernel panic happens due to the io_data buffer gets 
>> deallocated before the async io is completed. Add a check for the case 
>> where io_data buffer should be deallocated by ffs_user_copy_worker.
> 
> [snip]
>
> Please add tag - 'Fixes: 772a7a724f6 ("usb: gadget: f_fs: Allow scatter-gather buffers")
Sent [PATCH V2]

>> ---
>>  drivers/usb/gadget/function/f_fs.c | 3 ++-
>>  1 file changed, 2 insertions(+), 1 deletion(-)
>> 
>> diff --git a/drivers/usb/gadget/function/f_fs.c
>> b/drivers/usb/gadget/function/f_fs.c
>> index 20413c2..47be961 100644
>> --- a/drivers/usb/gadget/function/f_fs.c
>> +++ b/drivers/usb/gadget/function/f_fs.c
>> @@ -1133,7 +1133,8 @@ static ssize_t ffs_epfile_io(struct file *file,
>> struct ffs_io_data *io_data)
>>  error_mutex:
>>  	mutex_unlock(&epfile->mutex);
>>  error:
>> -	ffs_free_buffer(io_data);
>> +	if (ret != -EIOCBQUEUED) /* don't free if there is iocb queued */
>> +		ffs_free_buffer(io_data);
>>  	return ret;
>>  }