| From 6594570c80a0e04f39e54d77363020e1475e1941 Mon Sep 17 00:00:00 2001 |
| From: Johan Hovold <johan@kernel.org> |
| Date: Wed, 9 Oct 2019 17:38:44 +0200 |
| Subject: [PATCH] USB: adutux: fix use-after-free on release |
| |
| commit 123a0f125fa3d2104043697baa62899d9e549272 upstream. |
| |
| The driver was accessing its struct usb_device in its release() |
| callback without holding a reference. This would lead to a |
| use-after-free whenever the device was disconnected while the character |
| device was still open. |
| |
| Fixes: 66d4bc30d128 ("USB: adutux: remove custom debug macro") |
| Cc: stable <stable@vger.kernel.org> # 3.12 |
| Signed-off-by: Johan Hovold <johan@kernel.org> |
| Link: https://lore.kernel.org/r/20191009153848.8664-2-johan@kernel.org |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> |
| |
| diff --git a/drivers/usb/misc/adutux.c b/drivers/usb/misc/adutux.c |
| index aee542270e8b..9a51760df026 100644 |
| --- a/drivers/usb/misc/adutux.c |
| +++ b/drivers/usb/misc/adutux.c |
| @@ -149,6 +149,7 @@ static void adu_delete(struct adu_device *dev) |
| kfree(dev->read_buffer_secondary); |
| kfree(dev->interrupt_in_buffer); |
| kfree(dev->interrupt_out_buffer); |
| + usb_put_dev(dev->udev); |
| kfree(dev); |
| } |
| |
| @@ -666,7 +667,7 @@ static int adu_probe(struct usb_interface *interface, |
| |
| mutex_init(&dev->mtx); |
| spin_lock_init(&dev->buflock); |
| - dev->udev = udev; |
| + dev->udev = usb_get_dev(udev); |
| init_waitqueue_head(&dev->read_wait); |
| init_waitqueue_head(&dev->write_wait); |
| |
| -- |
| 2.7.4 |
| |
