this driver has a possible use after free due to a race when disconnect
and open handle intfdata without a lock.
Signed-off-by: Oliver Neukum <oneukum@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
#include <linux/init.h>
#include <linux/slab.h>
#include <linux/errno.h>
#include <linux/init.h>
#include <linux/slab.h>
#include <linux/errno.h>
+#include <linux/mutex.h>
#include <asm/uaccess.h>
#include <linux/usb.h>
#include <asm/uaccess.h>
#include <linux/usb.h>
};
MODULE_DEVICE_TABLE (usb, id_table);
};
MODULE_DEVICE_TABLE (usb, id_table);
+static DEFINE_MUTEX(open_disc_mutex);
+
struct usb_lcd {
struct usb_device * udev; /* init: probe_lcd */
struct usb_lcd {
struct usb_device * udev; /* init: probe_lcd */
+ mutex_lock(&open_disc_mutex);
dev = usb_get_intfdata(interface);
dev = usb_get_intfdata(interface);
+ if (!dev) {
+ mutex_unlock(&open_disc_mutex);
/* increment our usage count for the device */
kref_get(&dev->kref);
/* increment our usage count for the device */
kref_get(&dev->kref);
+ mutex_unlock(&open_disc_mutex);
/* grab a power reference */
r = usb_autopm_get_interface(interface);
/* grab a power reference */
r = usb_autopm_get_interface(interface);
struct usb_lcd *dev;
int minor = interface->minor;
struct usb_lcd *dev;
int minor = interface->minor;
+ mutex_lock(&open_disc_mutex);
dev = usb_get_intfdata(interface);
usb_set_intfdata(interface, NULL);
dev = usb_get_intfdata(interface);
usb_set_intfdata(interface, NULL);
+ mutex_unlock(&open_disc_mutex);
/* give back our minor */
usb_deregister_dev(interface, &lcd_class);
/* give back our minor */
usb_deregister_dev(interface, &lcd_class);