lkml.org 
[lkml]   [2006]   [Mar]   [6]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
Date
From
Subject[PATCH] USB Serial: fix use-after-free bug in usb-serial core
This fixes a use-after-free bug in the usb-serial core.  It is simple to
trigger this (open a usb-serial port, then yank the device out before
closing the port.) Thanks to Stefan Seyfried <seife@suse.de> for
reporting this, and to the slab debugging code which enabled it to be
tracked down.

Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

---
drivers/usb/serial/usb-serial.c | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)

--- gregkh-2.6.orig/drivers/usb/serial/usb-serial.c
+++ gregkh-2.6/drivers/usb/serial/usb-serial.c
@@ -242,8 +242,10 @@ static void serial_close(struct tty_stru

down(&port->sem);

- if (port->open_count == 0)
- goto out;
+ if (port->open_count == 0) {
+ up(&port->sem);
+ return;
+ }

--port->open_count;
if (port->open_count == 0) {
@@ -260,10 +262,8 @@ static void serial_close(struct tty_stru
module_put(port->serial->type->driver.owner);
}

- kref_put(&port->serial->kref, destroy_serial);
-
-out:
up(&port->sem);
+ kref_put(&port->serial->kref, destroy_serial);
}

static int serial_write (struct tty_struct * tty, const unsigned char *buf, int count)
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
\
 
 \ /
  Last update: 2006-03-06 22:41    [W:0.023 / U:0.412 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site