aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorJohan Hovold <johan@kernel.org>2019-10-15 19:55:22 +0200
committerPaul Gortmaker <paul.gortmaker@windriver.com>2019-11-09 19:33:57 -0500
commit4888496abcfe62a75eaa2f1bd7c84b38372ba99b (patch)
tree3ba9fb49c16da08de90d54fdc7038f6d454d07b9
parent0ba545e8fda841bf13585f0d78f6293d7642ed37 (diff)
downloadlinux-yocto-4888496abcfe62a75eaa2f1bd7c84b38372ba99b.tar.gz
linux-yocto-4888496abcfe62a75eaa2f1bd7c84b38372ba99b.tar.bz2
linux-yocto-4888496abcfe62a75eaa2f1bd7c84b38372ba99b.zip
USB: usblp: fix use-after-free on disconnect
commit 7a759197974894213621aa65f0571b51904733d6 upstream. A recent commit addressing a runtime PM use-count regression, introduced a use-after-free by not making sure we held a reference to the struct usb_interface for the lifetime of the driver data. Fixes: 9a31535859bf ("USB: usblp: fix runtime PM after driver unbind") Cc: stable <stable@vger.kernel.org> Reported-by: syzbot+cd24df4d075c319ebfc5@syzkaller.appspotmail.com Signed-off-by: Johan Hovold <johan@kernel.org> Link: https://lore.kernel.org/r/20191015175522.18490-1-johan@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
-rw-r--r--drivers/usb/class/usblp.c4
1 files changed, 3 insertions, 1 deletions
diff --git a/drivers/usb/class/usblp.c b/drivers/usb/class/usblp.c
index 502e9bf1746f..4a80103675d5 100644
--- a/drivers/usb/class/usblp.c
+++ b/drivers/usb/class/usblp.c
@@ -445,6 +445,7 @@ static void usblp_cleanup(struct usblp *usblp)
kfree(usblp->readbuf);
kfree(usblp->device_id_string);
kfree(usblp->statusbuf);
+ usb_put_intf(usblp->intf);
kfree(usblp);
}
@@ -1107,7 +1108,7 @@ static int usblp_probe(struct usb_interface *intf,
init_waitqueue_head(&usblp->wwait);
init_usb_anchor(&usblp->urbs);
usblp->ifnum = intf->cur_altsetting->desc.bInterfaceNumber;
- usblp->intf = intf;
+ usblp->intf = usb_get_intf(intf);
/* Malloc device ID string buffer to the largest expected length,
* since we can re-query it on an ioctl and a dynamic string
@@ -1196,6 +1197,7 @@ abort:
kfree(usblp->readbuf);
kfree(usblp->statusbuf);
kfree(usblp->device_id_string);
+ usb_put_intf(usblp->intf);
kfree(usblp);
abort_ret:
return retval;