lkml.org 
[lkml]   [2015]   [Mar]   [4]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 3.14 49/73] USB: fix use-after-free bug in usb_hcd_unlink_urb()
    Date
    3.14-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Alan Stern <stern@rowland.harvard.edu>

    commit c99197902da284b4b723451c1471c45b18537cde upstream.

    The usb_hcd_unlink_urb() routine in hcd.c contains two possible
    use-after-free errors. The dev_dbg() statement at the end of the
    routine dereferences urb and urb->dev even though both structures may
    have been deallocated.

    This patch fixes the problem by storing urb->dev in a local variable
    (avoiding the dereference of urb) and moving the dev_dbg() up before
    the usb_put_dev() call.

    Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
    Reported-by: Joe Lawrence <joe.lawrence@stratus.com>
    Tested-by: Joe Lawrence <joe.lawrence@stratus.com>
    Signed-off-by: Greg Kroah-Hartman <greg@kroah.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    drivers/usb/core/hcd.c | 16 ++++++++--------
    1 file changed, 8 insertions(+), 8 deletions(-)

    --- a/drivers/usb/core/hcd.c
    +++ b/drivers/usb/core/hcd.c
    @@ -1617,6 +1617,7 @@ static int unlink1(struct usb_hcd *hcd,
    int usb_hcd_unlink_urb (struct urb *urb, int status)
    {
    struct usb_hcd *hcd;
    + struct usb_device *udev = urb->dev;
    int retval = -EIDRM;
    unsigned long flags;

    @@ -1628,20 +1629,19 @@ int usb_hcd_unlink_urb (struct urb *urb,
    spin_lock_irqsave(&hcd_urb_unlink_lock, flags);
    if (atomic_read(&urb->use_count) > 0) {
    retval = 0;
    - usb_get_dev(urb->dev);
    + usb_get_dev(udev);
    }
    spin_unlock_irqrestore(&hcd_urb_unlink_lock, flags);
    if (retval == 0) {
    hcd = bus_to_hcd(urb->dev->bus);
    retval = unlink1(hcd, urb, status);
    - usb_put_dev(urb->dev);
    + if (retval == 0)
    + retval = -EINPROGRESS;
    + else if (retval != -EIDRM && retval != -EBUSY)
    + dev_dbg(&udev->dev, "hcd_unlink_urb %p fail %d\n",
    + urb, retval);
    + usb_put_dev(udev);
    }
    -
    - if (retval == 0)
    - retval = -EINPROGRESS;
    - else if (retval != -EIDRM && retval != -EBUSY)
    - dev_dbg(&urb->dev->dev, "hcd_unlink_urb %p fail %d\n",
    - urb, retval);
    return retval;
    }




    \
     
     \ /
      Last update: 2015-03-04 09:41    [W:2.121 / U:0.132 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site