lkml.org 
[lkml]   [2019]   [Aug]   [10]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Date
    Subject[PATCH 3.16 107/157] USB: yurex: Fix protection fault after device removal
    3.16.72-rc1 review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Alan Stern <stern@rowland.harvard.edu>

    commit ef61eb43ada6c1d6b94668f0f514e4c268093ff3 upstream.

    The syzkaller USB fuzzer found a general-protection-fault bug in the
    yurex driver. The fault occurs when a device has been unplugged; the
    driver's interrupt-URB handler logs an error message referring to the
    device by name, after the device has been unregistered and its name
    deallocated.

    This problem is caused by the fact that the interrupt URB isn't
    cancelled until the driver's private data structure is released, which
    can happen long after the device is gone. The cure is to make sure
    that the interrupt URB is killed before yurex_disconnect() returns;
    this is exactly the sort of thing that usb_poison_urb() was meant for.

    Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
    Reported-and-tested-by: syzbot+2eb9121678bdb36e6d57@syzkaller.appspotmail.com
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    ---
    drivers/usb/misc/yurex.c | 1 +
    1 file changed, 1 insertion(+)

    --- a/drivers/usb/misc/yurex.c
    +++ b/drivers/usb/misc/yurex.c
    @@ -332,6 +332,7 @@ static void yurex_disconnect(struct usb_
    usb_deregister_dev(interface, &yurex_class);

    /* prevent more I/O from starting */
    + usb_poison_urb(dev->urb);
    mutex_lock(&dev->io_mutex);
    dev->interface = NULL;
    mutex_unlock(&dev->io_mutex);
    \
     
     \ /
      Last update: 2019-08-10 22:51    [W:5.884 / U:0.032 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site