linux-usb.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Johan Hovold <johan@kernel.org>
To: linux-usb@vger.kernel.org
Cc: "Ahmed S . Darwish" <a.darwish@linutronix.de>,
	Sebastian Andrzej Siewior <bigeasy@linutronix.de>,
	Thomas Gleixner <tglx@linutronix.de>,
	linux-kernel@vger.kernel.org, Johan Hovold <johan@kernel.org>,
	stable@vger.kernel.org
Subject: [PATCH 05/14] USB: serial: keyspan_pda: fix tx-unthrottle use-after-free
Date: Sun, 25 Oct 2020 18:45:51 +0100	[thread overview]
Message-ID: <20201025174600.27896-6-johan@kernel.org> (raw)
In-Reply-To: <20201025174600.27896-1-johan@kernel.org>

The driver's transmit-unthrottle work was never flushed on disconnect,
something which could lead to the driver port data being freed while the
unthrottle work is still scheduled.

Fix this by cancelling the unthrottle work when shutting down the port.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Signed-off-by: Johan Hovold <johan@kernel.org>
---
 drivers/usb/serial/keyspan_pda.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/usb/serial/keyspan_pda.c b/drivers/usb/serial/keyspan_pda.c
index d91180ab5f3b..781b6723379f 100644
--- a/drivers/usb/serial/keyspan_pda.c
+++ b/drivers/usb/serial/keyspan_pda.c
@@ -647,8 +647,12 @@ static int keyspan_pda_open(struct tty_struct *tty,
 }
 static void keyspan_pda_close(struct usb_serial_port *port)
 {
+	struct keyspan_pda_private *priv = usb_get_serial_port_data(port);
+
 	usb_kill_urb(port->write_urb);
 	usb_kill_urb(port->interrupt_in_urb);
+
+	cancel_work_sync(&priv->unthrottle_work);
 }
 
 
-- 
2.26.2


  parent reply	other threads:[~2020-10-25 17:48 UTC|newest]

Thread overview: 22+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-10-25 17:45 [PATCH 00/14] USB: serial: keyspan_pda: fix up write implementation Johan Hovold
2020-10-25 17:45 ` [PATCH 01/14] USB: serial: keyspan_pda: fix dropped unthrottle interrupts Johan Hovold
2020-10-25 17:45 ` [PATCH 02/14] USB: serial: keyspan_pda: fix write deadlock Johan Hovold
2020-10-25 17:45 ` [PATCH 03/14] USB: serial: keyspan_pda: fix stalled writes Johan Hovold
2020-10-25 17:45 ` [PATCH 04/14] USB: serial: keyspan_pda: fix write-wakeup use-after-free Johan Hovold
2020-10-25 17:45 ` Johan Hovold [this message]
2020-10-25 17:45 ` [PATCH 06/14] USB: serial: keyspan_pda: fix write unthrottling Johan Hovold
2020-10-25 17:45 ` [PATCH 07/14] USB: serial: keyspan_pda: refactor write-room handling Johan Hovold
2020-10-25 17:45 ` [PATCH 08/14] USB: serial: keyspan_pda: fix write implementation Johan Hovold
2020-10-25 17:45 ` [PATCH 09/14] USB: serial: keyspan_pda: increase transmitter threshold Johan Hovold
2020-10-25 17:45 ` [PATCH 10/14] USB: serial: keyspan_pda: add write-fifo support Johan Hovold
2020-10-25 17:45 ` [PATCH 11/14] USB: serial: keyspan_pda: clean up xircom/entrega support Johan Hovold
2020-10-26 12:00   ` Sebastian Andrzej Siewior
2020-10-27  8:09     ` Johan Hovold
2020-10-27  9:25       ` [PATCH v2 " Johan Hovold
2020-10-25 17:45 ` [PATCH 12/14] USB: serial: keyspan_pda: clean up comments and whitespace Johan Hovold
2020-10-25 17:45 ` [PATCH 13/14] USB: serial: keyspan_pda: use BIT() macro Johan Hovold
2020-10-25 17:46 ` [PATCH 14/14] USB: serial: keyspan_pda: drop redundant usb-serial pointer Johan Hovold
2020-10-26 12:13 ` [PATCH 00/14] USB: serial: keyspan_pda: fix up write implementation Sebastian Andrzej Siewior
2020-10-27  8:11   ` Johan Hovold
2020-10-28  9:38 ` Greg KH
2020-11-04 10:04   ` Johan Hovold

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20201025174600.27896-6-johan@kernel.org \
    --to=johan@kernel.org \
    --cc=a.darwish@linutronix.de \
    --cc=bigeasy@linutronix.de \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-usb@vger.kernel.org \
    --cc=stable@vger.kernel.org \
    --cc=tglx@linutronix.de \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).