lkml.org 
[lkml]   [2020]   [Jan]   [16]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH AUTOSEL 4.4 147/174] USB: usb-skeleton: fix use-after-free after driver unbind
    Date
    From: Johan Hovold <johan@kernel.org>

    [ Upstream commit 6353001852776e7eeaab4da78922d4c6f2b076af ]

    The driver failed to stop its read URB on disconnect, something which
    could lead to a use-after-free in the completion handler after driver
    unbind in case the character device has been closed.

    Fixes: e7389cc9a7ff ("USB: skel_read really sucks royally")
    Signed-off-by: Johan Hovold <johan@kernel.org>
    Link: https://lore.kernel.org/r/20191009170944.30057-3-johan@kernel.org
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/usb/usb-skeleton.c | 1 +
    1 file changed, 1 insertion(+)

    diff --git a/drivers/usb/usb-skeleton.c b/drivers/usb/usb-skeleton.c
    index 871c366d9229..efc716f26cf5 100644
    --- a/drivers/usb/usb-skeleton.c
    +++ b/drivers/usb/usb-skeleton.c
    @@ -592,6 +592,7 @@ static void skel_disconnect(struct usb_interface *interface)
    dev->disconnected = 1;
    mutex_unlock(&dev->io_mutex);

    + usb_kill_urb(dev->bulk_in_urb);
    usb_kill_anchored_urbs(&dev->submitted);

    /* decrement our usage count */
    --
    2.20.1
    \
     
     \ /
      Last update: 2020-01-16 18:47    [W:4.142 / U:0.168 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site