From: Russ Dill Date: Wed, 18 Nov 2009 18:02:13 +0000 (-0700) Subject: USB: Close usb_find_interface race X-Git-Tag: v2.6.33-rc1~315^2~70 X-Git-Url: http://git.openpandora.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=a2582bd478c13c574d4c16ef1209d333f2a25935;p=pandora-kernel.git USB: Close usb_find_interface race USB drivers that create character devices call usb_register_dev in their probe function. This associates the usb_interface device with that minor number and creates the character device and announces it to the world. However, the driver's probe function is called before the new usb_interface is added to the driver's klist_devices. This is a problem because userspace will respond to the character device creation announcement by opening the character device. The driver's open function will the call usb_find_interface to find the usb_interface associated with that minor number. usb_find_interface will walk the driver's list of devices and find the usb_interface with the matching minor number. Because the announcement happens before the usb_interface is added to the driver's klist_devices, a race condition exists. A straightforward fix is to walk the list of devices on usb_bus_type instead since the device is added to that list before the announcement occurs. bus_find_device calls get_device to bump the reference count on the found device. It is arguable that the reference count should be dropped by the caller of usb_find_interface instead of usb_find_interface, however, the current users of usb_find_interface do not expect this. Signed-off-by: Russ Dill Cc: stable Signed-off-by: Greg Kroah-Hartman --- Reading git-diff-tree failed