HID: hidraw: protect hidraw_disconnect() better
authorJames Hogan <james.hogan@imgtec.com>
Tue, 20 Sep 2011 13:23:46 +0000 (15:23 +0200)
committerJiri Kosina <jkosina@suse.cz>
Tue, 20 Sep 2011 13:23:46 +0000 (15:23 +0200)
commit65b01bd561dc995aab116aa784f97a37f7c49a65
treecebcfb510b789147e185eba651d383d61c071ca9
parente4e436e0bd480668834fe6849a52c5397b7be4fb
HID: hidraw: protect hidraw_disconnect() better

The function hidraw_disconnect() only acquires the hidraw minors_lock
when clearing the entry in hidraw_table. However the device_destroy()
call can cause a userland read/write to return with an error. It may
cause the program to release the file descripter before the disconnect
is finished. hidraw_disconnect() has already set hidraw->exist to 0,
which makes hidraw_release() kfree the hidraw structure, which
hidraw_disconnect() continues to access and even tries to kfree again.
Similarly if a hidraw_release() occurs after setting hidraw->exist to 0,
the same thing can happen.

This is fixed by expanding the mutex critical section to cover the whole
function from setting hidraw->exist to 0 to freeing the hidraw
structure, preventing a hidraw_release() from interfering.

Signed-off-by: James Hogan <james.hogan@imgtec.com>
Tested-by: David Herrmann <dh.herrmann@googlemail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
drivers/hid/hidraw.c