| From 726b55d0e22ca72c69c947af87785c830289ddbc Mon Sep 17 00:00:00 2001 |
| From: Johan Hovold <johan@kernel.org> |
| Date: Wed, 9 Oct 2019 17:38:47 +0200 |
| Subject: USB: legousbtower: fix use-after-free on release |
| |
| From: Johan Hovold <johan@kernel.org> |
| |
| commit 726b55d0e22ca72c69c947af87785c830289ddbc upstream. |
| |
| The driver was accessing its struct usb_device in its release() |
| callback without holding a reference. This would lead to a |
| use-after-free whenever the device was disconnected while the character |
| device was still open. |
| |
| Fixes: fef526cae700 ("USB: legousbtower: remove custom debug macro") |
| Cc: stable <stable@vger.kernel.org> # 3.12 |
| Signed-off-by: Johan Hovold <johan@kernel.org> |
| Link: https://lore.kernel.org/r/20191009153848.8664-5-johan@kernel.org |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| |
| --- |
| drivers/usb/misc/legousbtower.c | 3 ++- |
| 1 file changed, 2 insertions(+), 1 deletion(-) |
| |
| --- a/drivers/usb/misc/legousbtower.c |
| +++ b/drivers/usb/misc/legousbtower.c |
| @@ -302,6 +302,7 @@ static inline void tower_delete (struct |
| kfree (dev->read_buffer); |
| kfree (dev->interrupt_in_buffer); |
| kfree (dev->interrupt_out_buffer); |
| + usb_put_dev(dev->udev); |
| kfree (dev); |
| } |
| |
| @@ -820,7 +821,7 @@ static int tower_probe (struct usb_inter |
| |
| mutex_init(&dev->lock); |
| |
| - dev->udev = udev; |
| + dev->udev = usb_get_dev(udev); |
| dev->open_count = 0; |
| dev->disconnected = 0; |
| |
