USB: disconnect open race in legousbtower
again, possible use after free due to touching intfdata without lock. Signed-off-by: Oliver Neukum <oneukum@suse.de> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
This commit is contained in:
parent
03f36e885f
commit
78663ecc34
1 changed files with 13 additions and 1 deletions
|
@ -198,6 +198,7 @@ static struct usb_device_id tower_table [] = {
|
||||||
};
|
};
|
||||||
|
|
||||||
MODULE_DEVICE_TABLE (usb, tower_table);
|
MODULE_DEVICE_TABLE (usb, tower_table);
|
||||||
|
static DEFINE_MUTEX(open_disc_mutex);
|
||||||
|
|
||||||
#define LEGO_USB_TOWER_MINOR_BASE 160
|
#define LEGO_USB_TOWER_MINOR_BASE 160
|
||||||
|
|
||||||
|
@ -350,25 +351,31 @@ static int tower_open (struct inode *inode, struct file *file)
|
||||||
goto exit;
|
goto exit;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
mutex_lock(&open_disc_mutex);
|
||||||
dev = usb_get_intfdata(interface);
|
dev = usb_get_intfdata(interface);
|
||||||
|
|
||||||
if (!dev) {
|
if (!dev) {
|
||||||
|
mutex_unlock(&open_disc_mutex);
|
||||||
retval = -ENODEV;
|
retval = -ENODEV;
|
||||||
goto exit;
|
goto exit;
|
||||||
}
|
}
|
||||||
|
|
||||||
/* lock this device */
|
/* lock this device */
|
||||||
if (down_interruptible (&dev->sem)) {
|
if (down_interruptible (&dev->sem)) {
|
||||||
|
mutex_unlock(&open_disc_mutex);
|
||||||
retval = -ERESTARTSYS;
|
retval = -ERESTARTSYS;
|
||||||
goto exit;
|
goto exit;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
||||||
/* allow opening only once */
|
/* allow opening only once */
|
||||||
if (dev->open_count) {
|
if (dev->open_count) {
|
||||||
|
mutex_unlock(&open_disc_mutex);
|
||||||
retval = -EBUSY;
|
retval = -EBUSY;
|
||||||
goto unlock_exit;
|
goto unlock_exit;
|
||||||
}
|
}
|
||||||
dev->open_count = 1;
|
dev->open_count = 1;
|
||||||
|
mutex_unlock(&open_disc_mutex);
|
||||||
|
|
||||||
/* reset the tower */
|
/* reset the tower */
|
||||||
result = usb_control_msg (dev->udev,
|
result = usb_control_msg (dev->udev,
|
||||||
|
@ -437,9 +444,10 @@ static int tower_release (struct inode *inode, struct file *file)
|
||||||
if (dev == NULL) {
|
if (dev == NULL) {
|
||||||
dbg(1, "%s: object is NULL", __FUNCTION__);
|
dbg(1, "%s: object is NULL", __FUNCTION__);
|
||||||
retval = -ENODEV;
|
retval = -ENODEV;
|
||||||
goto exit;
|
goto exit_nolock;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
mutex_lock(&open_disc_mutex);
|
||||||
if (down_interruptible (&dev->sem)) {
|
if (down_interruptible (&dev->sem)) {
|
||||||
retval = -ERESTARTSYS;
|
retval = -ERESTARTSYS;
|
||||||
goto exit;
|
goto exit;
|
||||||
|
@ -468,6 +476,8 @@ unlock_exit:
|
||||||
up (&dev->sem);
|
up (&dev->sem);
|
||||||
|
|
||||||
exit:
|
exit:
|
||||||
|
mutex_unlock(&open_disc_mutex);
|
||||||
|
exit_nolock:
|
||||||
dbg(2, "%s: leave, return value %d", __FUNCTION__, retval);
|
dbg(2, "%s: leave, return value %d", __FUNCTION__, retval);
|
||||||
return retval;
|
return retval;
|
||||||
}
|
}
|
||||||
|
@ -989,6 +999,7 @@ static void tower_disconnect (struct usb_interface *interface)
|
||||||
dbg(2, "%s: enter", __FUNCTION__);
|
dbg(2, "%s: enter", __FUNCTION__);
|
||||||
|
|
||||||
dev = usb_get_intfdata (interface);
|
dev = usb_get_intfdata (interface);
|
||||||
|
mutex_lock(&open_disc_mutex);
|
||||||
usb_set_intfdata (interface, NULL);
|
usb_set_intfdata (interface, NULL);
|
||||||
|
|
||||||
minor = dev->minor;
|
minor = dev->minor;
|
||||||
|
@ -997,6 +1008,7 @@ static void tower_disconnect (struct usb_interface *interface)
|
||||||
usb_deregister_dev (interface, &tower_class);
|
usb_deregister_dev (interface, &tower_class);
|
||||||
|
|
||||||
down (&dev->sem);
|
down (&dev->sem);
|
||||||
|
mutex_unlock(&open_disc_mutex);
|
||||||
|
|
||||||
/* if the device is not opened, then we clean up right now */
|
/* if the device is not opened, then we clean up right now */
|
||||||
if (!dev->open_count) {
|
if (!dev->open_count) {
|
||||||
|
|
Reference in a new issue