Gitweb:
http://git.kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=d5d1ceac2a47645780bd07fd7a670b14c4d995db
Commit: d5d1ceac2a47645780bd07fd7a670b14c4d995db
Parent: 78663ecc344b4694dd737deb682e81312a0684b6
Author: Oliver Neukum <[EMAIL PROTECTED]>
AuthorDate: Thu Oct 25 16:05:53 2007 +0200
Committer: Greg Kroah-Hartman <[EMAIL PROTECTED]>
CommitDate: Thu Oct 25 12:18:46 2007 -0700
USB: open disconnect race in usblcd
this driver has a possible use after free due to a race when disconnect
and open handle intfdata without a lock.
Signed-off-by: Oliver Neukum <[EMAIL PROTECTED]>
Signed-off-by: Greg Kroah-Hartman <[EMAIL PROTECTED]>
---
drivers/usb/misc/usblcd.c | 11 ++++++++++-
1 files changed, 10 insertions(+), 1 deletions(-)
diff --git a/drivers/usb/misc/usblcd.c b/drivers/usb/misc/usblcd.c
index 7198420..20777d0 100644
--- a/drivers/usb/misc/usblcd.c
+++ b/drivers/usb/misc/usblcd.c
@@ -17,6 +17,7 @@
#include <linux/init.h>
#include <linux/slab.h>
#include <linux/errno.h>
+#include <linux/mutex.h>
#include <asm/uaccess.h>
#include <linux/usb.h>
@@ -34,6 +35,8 @@ static struct usb_device_id id_table [] = {
};
MODULE_DEVICE_TABLE (usb, id_table);
+static DEFINE_MUTEX(open_disc_mutex);
+
struct usb_lcd {
struct usb_device * udev; /* init: probe_lcd */
@@ -79,12 +82,16 @@ static int lcd_open(struct inode *inode, struct file *file)
return -ENODEV;
}
+ mutex_lock(&open_disc_mutex);
dev = usb_get_intfdata(interface);
- if (!dev)
+ if (!dev) {
+ mutex_unlock(&open_disc_mutex);
return -ENODEV;
+ }
/* increment our usage count for the device */
kref_get(&dev->kref);
+ mutex_unlock(&open_disc_mutex);
/* grab a power reference */
r = usb_autopm_get_interface(interface);
@@ -393,8 +400,10 @@ static void lcd_disconnect(struct usb_interface *interface)
struct usb_lcd *dev;
int minor = interface->minor;
+ mutex_lock(&open_disc_mutex);
dev = usb_get_intfdata(interface);
usb_set_intfdata(interface, NULL);
+ mutex_unlock(&open_disc_mutex);
/* give back our minor */
usb_deregister_dev(interface, &lcd_class);
-
To unsubscribe from this list: send the line "unsubscribe git-commits-head" in
the body of a message to [EMAIL PROTECTED]
More majordomo info at http://vger.kernel.org/majordomo-info.html
