diff options
| author |   Oliver Neukum <oliver@neukum.org> | 2007-10-25 16:05:53 +0200 |
|---|---|---|
| committer |   Greg Kroah-Hartman <gregkh@suse.de> | 2007-10-25 12:18:46 -0700 |
| commit | d5d1ceac2a47645780bd07fd7a670b14c4d995db (patch) | |
| tree | 9c2fa21fa6339fb25544bbed82b249b5d62a36c4 /drivers/usb | |
| parent | USB: disconnect open race in legousbtower (diff) | |
| download | linux-dev-d5d1ceac2a47645780bd07fd7a670b14c4d995db.tar.xz linux-dev-d5d1ceac2a47645780bd07fd7a670b14c4d995db.zip | |
USB: open disconnect race in usblcd
this driver has a possible use after free due to a race when disconnect
and open handle intfdata without a lock.
Signed-off-by: Oliver Neukum <oneukum@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Diffstat (limited to 'drivers/usb')
| -rw-r--r-- | drivers/usb/misc/usblcd.c | 11 |
1 files changed, 10 insertions, 1 deletions
diff --git a/drivers/usb/misc/usblcd.c b/drivers/usb/misc/usblcd.c index 719842032712..20777d01db62 100644 --- a/drivers/usb/misc/usblcd.c +++ b/drivers/usb/misc/usblcd.c @@ -17,6 +17,7 @@ #include <linux/init.h> #include <linux/slab.h> #include <linux/errno.h> +#include <linux/mutex.h> #include <asm/uaccess.h> #include <linux/usb.h> @@ -34,6 +35,8 @@ static struct usb_device_id id_table [] = { }; MODULE_DEVICE_TABLE (usb, id_table); +static DEFINE_MUTEX(open_disc_mutex); + struct usb_lcd { struct usb_device * udev; /* init: probe_lcd */ @@ -79,12 +82,16 @@ static int lcd_open(struct inode *inode, struct file *file) return -ENODEV; } + mutex_lock(&open_disc_mutex); dev = usb_get_intfdata(interface); - if (!dev) + if (!dev) { + mutex_unlock(&open_disc_mutex); return -ENODEV; + } /* increment our usage count for the device */ kref_get(&dev->kref); + mutex_unlock(&open_disc_mutex); /* grab a power reference */ r = usb_autopm_get_interface(interface); @@ -393,8 +400,10 @@ static void lcd_disconnect(struct usb_interface *interface) struct usb_lcd *dev; int minor = interface->minor; + mutex_lock(&open_disc_mutex); dev = usb_get_intfdata(interface); usb_set_intfdata(interface, NULL); + mutex_unlock(&open_disc_mutex); /* give back our minor */ usb_deregister_dev(interface, &lcd_class); |