| From 123a0f125fa3d2104043697baa62899d9e549272 Mon Sep 17 00:00:00 2001 |
| From: Johan Hovold <johan@kernel.org> |
| Date: Wed, 9 Oct 2019 17:38:44 +0200 |
| Subject: USB: adutux: fix use-after-free on release |
| |
| From: Johan Hovold <johan@kernel.org> |
| |
| commit 123a0f125fa3d2104043697baa62899d9e549272 upstream. |
| |
| The driver was accessing its struct usb_device in its release() |
| callback without holding a reference. This would lead to a |
| use-after-free whenever the device was disconnected while the character |
| device was still open. |
| |
| Fixes: 66d4bc30d128 ("USB: adutux: remove custom debug macro") |
| Cc: stable <stable@vger.kernel.org> # 3.12 |
| Signed-off-by: Johan Hovold <johan@kernel.org> |
| Link: https://lore.kernel.org/r/20191009153848.8664-2-johan@kernel.org |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| |
| --- |
| drivers/usb/misc/adutux.c | 3 ++- |
| 1 file changed, 2 insertions(+), 1 deletion(-) |
| |
| --- a/drivers/usb/misc/adutux.c |
| +++ b/drivers/usb/misc/adutux.c |
| @@ -152,6 +152,7 @@ static void adu_delete(struct adu_device |
| kfree(dev->read_buffer_secondary); |
| kfree(dev->interrupt_in_buffer); |
| kfree(dev->interrupt_out_buffer); |
| + usb_put_dev(dev->udev); |
| kfree(dev); |
| } |
| |
| @@ -680,7 +681,7 @@ static int adu_probe(struct usb_interfac |
| |
| mutex_init(&dev->mtx); |
| spin_lock_init(&dev->buflock); |
| - dev->udev = udev; |
| + dev->udev = usb_get_dev(udev); |
| init_waitqueue_head(&dev->read_wait); |
| init_waitqueue_head(&dev->write_wait); |
| |