| From f1366d3eb26d872e85febafe34a633c8486ef328 Mon Sep 17 00:00:00 2001 |
| From: Johan Hovold <johan@kernel.org> |
| Date: Wed, 9 Oct 2019 17:38:47 +0200 |
| Subject: [PATCH] USB: legousbtower: fix use-after-free on release |
| |
| commit 726b55d0e22ca72c69c947af87785c830289ddbc upstream. |
| |
| The driver was accessing its struct usb_device in its release() |
| callback without holding a reference. This would lead to a |
| use-after-free whenever the device was disconnected while the character |
| device was still open. |
| |
| Fixes: fef526cae700 ("USB: legousbtower: remove custom debug macro") |
| Cc: stable <stable@vger.kernel.org> # 3.12 |
| Signed-off-by: Johan Hovold <johan@kernel.org> |
| Link: https://lore.kernel.org/r/20191009153848.8664-5-johan@kernel.org |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> |
| |
| diff --git a/drivers/usb/misc/legousbtower.c b/drivers/usb/misc/legousbtower.c |
| index 44d6a3381804..9d4c52a7ebe0 100644 |
| --- a/drivers/usb/misc/legousbtower.c |
| +++ b/drivers/usb/misc/legousbtower.c |
| @@ -296,6 +296,7 @@ static inline void tower_delete (struct lego_usb_tower *dev) |
| kfree (dev->read_buffer); |
| kfree (dev->interrupt_in_buffer); |
| kfree (dev->interrupt_out_buffer); |
| + usb_put_dev(dev->udev); |
| kfree (dev); |
| } |
| |
| @@ -810,7 +811,7 @@ static int tower_probe (struct usb_interface *interface, const struct usb_device |
| |
| mutex_init(&dev->lock); |
| |
| - dev->udev = udev; |
| + dev->udev = usb_get_dev(udev); |
| dev->open_count = 0; |
| dev->disconnected = 0; |
| |
| -- |
| 2.7.4 |
| |
