evie/android_kernel_oneplus_msm8998
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

USB: open disconnect race in iowarrior

Browse source 
the driver sets intfdata to NULL without lock. Data structures can be
freed and accessed.

Signed-off-by: Oliver Neukum <oneukum@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
This commit is contained in:
Oliver Neukum 2007-10-25 15:46:30 +02:00 • committed by Greg Kroah-Hartman
parent 5919a43bbc
commit 03f36e885f
1 changed files with 8 additions and 1 deletions

9
drivers/usb/misc/iowarrior.c
View file

@ -66,6 +66,7 @@ module_param(debug, bool, 0644);
MODULE_PARM_DESC(debug, "debug=1 enables debugging messages"); MODULE_PARM_DESC(debug, "debug=1 enables debugging messages");
static struct usb_driver iowarrior_driver; static struct usb_driver iowarrior_driver;
static DEFINE_MUTEX(iowarrior_open_disc_lock);
/*--------------*/ /*--------------*/
/* data */ /* data */
@ -608,11 +609,15 @@ static int iowarrior_open(struct inode *inode, struct file *file)
return -ENODEV; return -ENODEV;
} }
mutex_lock(&iowarrior_open_disc_lock);
dev = usb_get_intfdata(interface); dev = usb_get_intfdata(interface);
if (!dev) if (!dev) {
mutex_unlock(&iowarrior_open_disc_lock);
return -ENODEV; return -ENODEV;
}
mutex_lock(&dev->mutex); mutex_lock(&dev->mutex);
mutex_unlock(&iowarrior_open_disc_lock);
/* Only one process can open each device, no sharing. */ /* Only one process can open each device, no sharing. */
if (dev->opened) { if (dev->opened) {
@ -866,6 +871,7 @@ static void iowarrior_disconnect(struct usb_interface *interface)
int minor; int minor;
dev = usb_get_intfdata(interface); dev = usb_get_intfdata(interface);
mutex_lock(&iowarrior_open_disc_lock);
usb_set_intfdata(interface, NULL); usb_set_intfdata(interface, NULL);
minor = dev->minor; minor = dev->minor;
@ -879,6 +885,7 @@ static void iowarrior_disconnect(struct usb_interface *interface)
dev->present = 0; dev->present = 0;
mutex_unlock(&dev->mutex); mutex_unlock(&dev->mutex);
mutex_unlock(&iowarrior_open_disc_lock);
if (dev->opened) { if (dev->opened) {
/* There is a process that holds a filedescriptor to the device , /* There is a process that holds a filedescriptor to the device ,