evie/android_kernel_oneplus_msm8998
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

USB: fix use-after-free bug in usb_hcd_unlink_urb()

Browse source 
The usb_hcd_unlink_urb() routine in hcd.c contains two possible
use-after-free errors.  The dev_dbg() statement at the end of the
routine dereferences urb and urb->dev even though both structures may
have been deallocated.

This patch fixes the problem by storing urb->dev in a local variable
(avoiding the dereference of urb) and moving the dev_dbg() up before
the usb_put_dev() call.

Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Reported-by: Joe Lawrence <joe.lawrence@stratus.com>
Tested-by: Joe Lawrence <joe.lawrence@stratus.com>
CC: <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <greg@kroah.com>
This commit is contained in:
Alan Stern 2015-01-30 12:58:26 -05:00 • committed by Greg Kroah-Hartman
parent cefa9a31a5
commit c99197902d
1 changed files with 8 additions and 8 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

16
drivers/usb/core/hcd.c
View file

@ -1618,6 +1618,7 @@ static int unlink1(struct usb_hcd *hcd, struct urb *urb, int status)
int usb_hcd_unlink_urb (struct urb *urb, int status) int usb_hcd_unlink_urb (struct urb *urb, int status)
{ {
struct usb_hcd *hcd; struct usb_hcd *hcd;
struct usb_device *udev = urb->dev;
int retval = -EIDRM; int retval = -EIDRM;
unsigned long flags; unsigned long flags;
@ -1629,20 +1630,19 @@ int usb_hcd_unlink_urb (struct urb *urb, int status)
spin_lock_irqsave(&hcd_urb_unlink_lock, flags); spin_lock_irqsave(&hcd_urb_unlink_lock, flags);
if (atomic_read(&urb->use_count) > 0) { if (atomic_read(&urb->use_count) > 0) {
retval = 0; retval = 0;
usb_get_dev(urb->dev); usb_get_dev(udev);
} }
spin_unlock_irqrestore(&hcd_urb_unlink_lock, flags); spin_unlock_irqrestore(&hcd_urb_unlink_lock, flags);
if (retval == 0) { if (retval == 0) {
hcd = bus_to_hcd(urb->dev->bus); hcd = bus_to_hcd(urb->dev->bus);
retval = unlink1(hcd, urb, status); retval = unlink1(hcd, urb, status);
usb_put_dev(urb->dev); if (retval == 0)
retval = -EINPROGRESS;
else if (retval != -EIDRM && retval != -EBUSY)
dev_dbg(&udev->dev, "hcd_unlink_urb %p fail %d\n",
urb, retval);
usb_put_dev(udev);
} }
if (retval == 0)
retval = -EINPROGRESS;
else if (retval != -EIDRM && retval != -EBUSY)
dev_dbg(&urb->dev->dev, "hcd_unlink_urb %p fail %d\n",
urb, retval);
return retval; return retval;
} }