| From 608eb0cf84484e72ad8411403c96ab99eec18635 Mon Sep 17 00:00:00 2001 |
| From: Serge Hallyn <serge.hallyn@canonical.com> |
| Date: Mon, 26 Sep 2011 10:18:29 -0500 |
| Subject: [PATCH] USB: pid_ns: ensure pid is not freed during |
| kill_pid_info_as_uid |
| |
| commit aec01c5895051849ed842dc5b8794017a7751f28 upstream. |
| |
| Alan Stern points out that after spin_unlock(&ps->lock) there is no |
| guarantee that ps->pid won't be freed. Since kill_pid_info_as_uid() is |
| called after the spin_unlock(), the pid passed to it must be pinned. |
| |
| Reported-by: Alan Stern <stern@rowland.harvard.edu> |
| Signed-off-by: Serge Hallyn <serge.hallyn@canonical.com> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> |
| Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> |
| |
| diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c |
| index 6088192..85a4967 100644 |
| --- a/drivers/usb/core/devio.c |
| +++ b/drivers/usb/core/devio.c |
| @@ -409,7 +409,7 @@ static void async_completed(struct urb *urb) |
| sinfo.si_errno = as->status; |
| sinfo.si_code = SI_ASYNCIO; |
| sinfo.si_addr = as->userurb; |
| - pid = as->pid; |
| + pid = get_pid(as->pid); |
| uid = as->uid; |
| euid = as->euid; |
| secid = as->secid; |
| @@ -424,9 +424,11 @@ static void async_completed(struct urb *urb) |
| cancel_bulk_urbs(ps, as->bulk_addr); |
| spin_unlock(&ps->lock); |
| |
| - if (signr) |
| + if (signr) { |
| kill_pid_info_as_uid(sinfo.si_signo, &sinfo, pid, uid, |
| euid, secid); |
| + put_pid(pid); |
| + } |
| |
| wake_up(&ps->wait); |
| } |
| -- |
| 1.7.12.rc1.1.gbce1580 |
| |
