lkml.org 
[lkml]   [2014]   [Jun]   [28]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 3.4 25/43] USB: sierra: fix use after free at suspend/resume
    Date
    3.4-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Johan Hovold <jhovold@gmail.com>

    commit 8452727de70f6ad850cd6d0aaa18b5d9050aa63b upstream.

    Fix use after free or NULL-pointer dereference during suspend and
    resume.

    The port data may never have been allocated (port probe failed)
    or may already have been released by port_remove (e.g. driver is
    unloaded) when suspend and resume are called.

    Fixes: e6929a9020ac ("USB: support for autosuspend in sierra while
    online")

    Signed-off-by: Johan Hovold <jhovold@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    drivers/usb/serial/sierra.c | 6 ++++++
    1 file changed, 6 insertions(+)

    --- a/drivers/usb/serial/sierra.c
    +++ b/drivers/usb/serial/sierra.c
    @@ -999,6 +999,7 @@ static void sierra_release(struct usb_se
    portdata = usb_get_serial_port_data(port);
    if (!portdata)
    continue;
    + usb_set_serial_port_data(port, NULL);
    kfree(portdata);
    }
    kfree(serial->private);
    @@ -1015,6 +1016,8 @@ static void stop_read_write_urbs(struct
    for (i = 0; i < serial->num_ports; ++i) {
    port = serial->port[i];
    portdata = usb_get_serial_port_data(port);
    + if (!portdata)
    + continue;
    sierra_stop_rx_urbs(port);
    usb_kill_anchored_urbs(&portdata->active);
    }
    @@ -1057,6 +1060,9 @@ static int sierra_resume(struct usb_seri
    port = serial->port[i];
    portdata = usb_get_serial_port_data(port);

    + if (!portdata)
    + continue;
    +
    while ((urb = usb_get_from_anchor(&portdata->delayed))) {
    usb_anchor_urb(urb, &portdata->active);
    intfdata->in_flight++;



    \
     
     \ /
      Last update: 2014-06-28 22:21    [W:5.745 / U:0.072 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site