From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, Johan Hovold <johan@kernel.org>
Subject: [PATCH 4.19 16/81] USB: adutux: fix NULL-derefs on disconnect
Date: Wed, 16 Oct 2019 14:50:27 -0700 [thread overview]
Message-ID: <20191016214821.983401763@linuxfoundation.org> (raw)
In-Reply-To: <20191016214805.727399379@linuxfoundation.org>
From: Johan Hovold <johan@kernel.org>
commit b2fa7baee744fde746c17bc1860b9c6f5c2eebb7 upstream.
The driver was using its struct usb_device pointer as an inverted
disconnected flag, but was setting it to NULL before making sure all
completion handlers had run. This could lead to a NULL-pointer
dereference in a number of dev_dbg statements in the completion handlers
which relies on said pointer.
The pointer was also dereferenced unconditionally in a dev_dbg statement
release() something which would lead to a NULL-deref whenever a device
was disconnected before the final character-device close if debugging
was enabled.
Fix this by unconditionally stopping all I/O and preventing
resubmissions by poisoning the interrupt URBs at disconnect and using a
dedicated disconnected flag.
This also makes sure that all I/O has completed by the time the
disconnect callback returns.
Fixes: 1ef37c6047fe ("USB: adutux: remove custom debug macro and module parameter")
Fixes: 66d4bc30d128 ("USB: adutux: remove custom debug macro")
Cc: stable <stable@vger.kernel.org> # 3.12
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://lore.kernel.org/r/20190925092913.8608-2-johan@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/misc/adutux.c | 16 ++++++++++------
1 file changed, 10 insertions(+), 6 deletions(-)
--- a/drivers/usb/misc/adutux.c
+++ b/drivers/usb/misc/adutux.c
@@ -75,6 +75,7 @@ struct adu_device {
char serial_number[8];
int open_count; /* number of times this port has been opened */
+ unsigned long disconnected:1;
char *read_buffer_primary;
int read_buffer_length;
@@ -116,7 +117,7 @@ static void adu_abort_transfers(struct a
{
unsigned long flags;
- if (dev->udev == NULL)
+ if (dev->disconnected)
return;
/* shutdown transfer */
@@ -243,7 +244,7 @@ static int adu_open(struct inode *inode,
}
dev = usb_get_intfdata(interface);
- if (!dev || !dev->udev) {
+ if (!dev) {
retval = -ENODEV;
goto exit_no_device;
}
@@ -326,7 +327,7 @@ static int adu_release(struct inode *ino
}
adu_release_internal(dev);
- if (dev->udev == NULL) {
+ if (dev->disconnected) {
/* the device was unplugged before the file was released */
if (!dev->open_count) /* ... and we're the last user */
adu_delete(dev);
@@ -355,7 +356,7 @@ static ssize_t adu_read(struct file *fil
return -ERESTARTSYS;
/* verify that the device wasn't unplugged */
- if (dev->udev == NULL) {
+ if (dev->disconnected) {
retval = -ENODEV;
pr_err("No device or device unplugged %d\n", retval);
goto exit;
@@ -520,7 +521,7 @@ static ssize_t adu_write(struct file *fi
goto exit_nolock;
/* verify that the device wasn't unplugged */
- if (dev->udev == NULL) {
+ if (dev->disconnected) {
retval = -ENODEV;
pr_err("No device or device unplugged %d\n", retval);
goto exit;
@@ -766,11 +767,14 @@ static void adu_disconnect(struct usb_in
usb_deregister_dev(interface, &adu_class);
+ usb_poison_urb(dev->interrupt_in_urb);
+ usb_poison_urb(dev->interrupt_out_urb);
+
mutex_lock(&adutux_mutex);
usb_set_intfdata(interface, NULL);
mutex_lock(&dev->mtx); /* not interruptible */
- dev->udev = NULL; /* poison */
+ dev->disconnected = 1;
mutex_unlock(&dev->mtx);
/* if the device is not opened, then we clean up right now */
next prev parent reply other threads:[~2019-10-16 21:57 UTC|newest]
Thread overview: 104+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-10-16 21:50 [PATCH 4.19 00/81] 4.19.80-stable review Greg Kroah-Hartman
2019-10-16 21:50 ` [PATCH 4.19 01/81] panic: ensure preemption is disabled during panic() Greg Kroah-Hartman
2019-10-16 21:50 ` [PATCH 4.19 02/81] f2fs: use EINVAL for superblock with invalid magic Greg Kroah-Hartman
2019-10-16 21:50 ` [PATCH 4.19 03/81] USB: rio500: Remove Rio 500 kernel driver Greg Kroah-Hartman
2019-10-16 21:50 ` [PATCH 4.19 04/81] USB: yurex: Dont retry on unexpected errors Greg Kroah-Hartman
2019-10-16 21:50 ` [PATCH 4.19 05/81] USB: yurex: fix NULL-derefs on disconnect Greg Kroah-Hartman
2019-10-16 21:50 ` [PATCH 4.19 06/81] USB: usb-skeleton: fix runtime PM after driver unbind Greg Kroah-Hartman
2019-10-16 21:50 ` [PATCH 4.19 07/81] USB: usb-skeleton: fix NULL-deref on disconnect Greg Kroah-Hartman
2019-10-16 21:50 ` [PATCH 4.19 08/81] xhci: Fix false warning message about wrong bounce buffer write length Greg Kroah-Hartman
2019-10-16 21:50 ` [PATCH 4.19 09/81] xhci: Prevent device initiated U1/U2 link pm if exit latency is too long Greg Kroah-Hartman
2019-10-16 21:50 ` [PATCH 4.19 10/81] xhci: Check all endpoints for LPM timeout Greg Kroah-Hartman
2019-10-16 21:50 ` [PATCH 4.19 11/81] xhci: Fix USB 3.1 capability detection on early xHCI 1.1 spec based hosts Greg Kroah-Hartman
2019-10-16 21:50 ` [PATCH 4.19 12/81] usb: xhci: wait for CNR controller not ready bit in xhci resume Greg Kroah-Hartman
2019-10-18 17:28 ` Pavel Machek
2019-10-16 21:50 ` [PATCH 4.19 13/81] xhci: Prevent deadlock when xhci adapter breaks during init Greg Kroah-Hartman
2019-10-16 21:50 ` [PATCH 4.19 14/81] xhci: Increase STS_SAVE timeout in xhci_suspend() Greg Kroah-Hartman
2019-10-16 21:50 ` [PATCH 4.19 15/81] USB: adutux: fix use-after-free on disconnect Greg Kroah-Hartman
2019-10-16 21:50 ` Greg Kroah-Hartman [this message]
2019-10-16 21:50 ` [PATCH 4.19 17/81] USB: adutux: fix use-after-free on release Greg Kroah-Hartman
2019-10-16 21:50 ` [PATCH 4.19 18/81] USB: iowarrior: fix use-after-free on disconnect Greg Kroah-Hartman
2019-10-16 21:50 ` [PATCH 4.19 19/81] USB: iowarrior: fix use-after-free on release Greg Kroah-Hartman
2019-10-16 21:50 ` [PATCH 4.19 20/81] USB: iowarrior: fix use-after-free after driver unbind Greg Kroah-Hartman
2019-10-16 21:50 ` [PATCH 4.19 21/81] USB: usblp: fix runtime PM " Greg Kroah-Hartman
2019-10-16 21:50 ` [PATCH 4.19 22/81] USB: chaoskey: fix use-after-free on release Greg Kroah-Hartman
2019-10-16 21:50 ` [PATCH 4.19 23/81] USB: ldusb: fix NULL-derefs on driver unbind Greg Kroah-Hartman
2019-10-16 21:50 ` [PATCH 4.19 24/81] serial: uartlite: fix exit path null pointer Greg Kroah-Hartman
2019-10-16 21:50 ` [PATCH 4.19 25/81] USB: serial: keyspan: fix NULL-derefs on open() and write() Greg Kroah-Hartman
2019-10-16 21:50 ` [PATCH 4.19 26/81] USB: serial: ftdi_sio: add device IDs for Sienna and Echelon PL-20 Greg Kroah-Hartman
2019-10-16 21:50 ` [PATCH 4.19 27/81] USB: serial: option: add Telit FN980 compositions Greg Kroah-Hartman
2019-10-16 21:50 ` [PATCH 4.19 28/81] USB: serial: option: add support for Cinterion CLS8 devices Greg Kroah-Hartman
2019-10-16 21:50 ` [PATCH 4.19 29/81] USB: serial: fix runtime PM after driver unbind Greg Kroah-Hartman
2019-10-16 21:50 ` [PATCH 4.19 30/81] USB: usblcd: fix I/O after disconnect Greg Kroah-Hartman
2019-10-16 21:50 ` [PATCH 4.19 31/81] USB: microtek: fix info-leak at probe Greg Kroah-Hartman
2019-10-16 21:50 ` [PATCH 4.19 32/81] USB: dummy-hcd: fix power budget for SuperSpeed mode Greg Kroah-Hartman
2019-10-16 21:50 ` [PATCH 4.19 33/81] usb: renesas_usbhs: gadget: Do not discard queues in usb_ep_set_{halt,wedge}() Greg Kroah-Hartman
2019-10-16 21:50 ` [PATCH 4.19 34/81] usb: renesas_usbhs: gadget: Fix usb_ep_set_{halt,wedge}() behavior Greg Kroah-Hartman
2019-10-16 21:50 ` [PATCH 4.19 35/81] USB: legousbtower: fix slab info leak at probe Greg Kroah-Hartman
2019-10-16 21:50 ` [PATCH 4.19 36/81] USB: legousbtower: fix deadlock on disconnect Greg Kroah-Hartman
2019-10-16 21:50 ` [PATCH 4.19 37/81] USB: legousbtower: fix potential NULL-deref " Greg Kroah-Hartman
2019-10-16 21:50 ` [PATCH 4.19 38/81] USB: legousbtower: fix open after failed reset request Greg Kroah-Hartman
2019-10-16 21:50 ` [PATCH 4.19 39/81] USB: legousbtower: fix use-after-free on release Greg Kroah-Hartman
2019-10-16 21:50 ` [PATCH 4.19 40/81] mei: me: add comet point (lake) LP device ids Greg Kroah-Hartman
2019-10-16 21:50 ` [PATCH 4.19 41/81] mei: avoid FW version request on Ibex Peak and earlier Greg Kroah-Hartman
2019-10-16 21:50 ` [PATCH 4.19 42/81] gpio: eic: sprd: Fix the incorrect EIC offset when toggling Greg Kroah-Hartman
2019-10-16 21:50 ` [PATCH 4.19 43/81] Staging: fbtft: fix memory leak in fbtft_framebuffer_alloc Greg Kroah-Hartman
2019-10-16 21:50 ` [PATCH 4.19 44/81] staging: vt6655: Fix memory leak in vt6655_probe Greg Kroah-Hartman
2019-10-16 21:50 ` [PATCH 4.19 45/81] iio: adc: hx711: fix bug in sampling of data Greg Kroah-Hartman
2019-10-16 21:50 ` [PATCH 4.19 46/81] iio: adc: ad799x: fix probe error handling Greg Kroah-Hartman
2019-10-16 21:50 ` [PATCH 4.19 47/81] iio: adc: axp288: Override TS pin bias current for some models Greg Kroah-Hartman
2019-10-16 21:50 ` [PATCH 4.19 48/81] iio: light: opt3001: fix mutex unlock race Greg Kroah-Hartman
2019-10-16 21:51 ` [PATCH 4.19 49/81] efivar/ssdt: Dont iterate over EFI vars if no SSDT override was specified Greg Kroah-Hartman
2019-10-16 21:51 ` [PATCH 4.19 50/81] perf llvm: Dont access out-of-scope array Greg Kroah-Hartman
2019-10-16 21:51 ` [PATCH 4.19 51/81] perf inject jit: Fix JIT_CODE_MOVE filename Greg Kroah-Hartman
2019-10-16 21:51 ` [PATCH 4.19 52/81] blk-wbt: fix performance regression in wbt scale_up/scale_down Greg Kroah-Hartman
2019-10-16 21:51 ` [PATCH 4.19 53/81] CIFS: Gracefully handle QueryInfo errors during open Greg Kroah-Hartman
2019-10-16 21:51 ` [PATCH 4.19 54/81] CIFS: Force revalidate inode when dentry is stale Greg Kroah-Hartman
2019-10-16 21:51 ` [PATCH 4.19 55/81] CIFS: Force reval dentry if LOOKUP_REVAL flag is set Greg Kroah-Hartman
2019-10-16 21:51 ` [PATCH 4.19 56/81] kernel/sysctl.c: do not override max_threads provided by userspace Greg Kroah-Hartman
2019-10-17 10:59 ` Pavel Machek
2019-10-17 11:05 ` Michal Hocko
2019-10-17 11:25 ` David Laight
2019-10-17 11:39 ` Michal Hocko
2019-11-18 15:25 ` Pavel Machek
2019-11-18 15:52 ` Michal Hocko
2019-10-16 21:51 ` [PATCH 4.19 57/81] mm/vmpressure.c: fix a signedness bug in vmpressure_register_event() Greg Kroah-Hartman
2019-10-16 21:51 ` [PATCH 4.19 58/81] firmware: google: increment VPD key_len properly Greg Kroah-Hartman
2019-10-16 21:51 ` [PATCH 4.19 59/81] gpiolib: dont clear FLAG_IS_OUT when emulating open-drain/open-source Greg Kroah-Hartman
2019-10-16 21:51 ` [PATCH 4.19 60/81] iio: adc: stm32-adc: move registers definitions Greg Kroah-Hartman
2019-10-16 21:51 ` [PATCH 4.19 61/81] iio: adc: stm32-adc: fix a race when using several adcs with dma and irq Greg Kroah-Hartman
2019-10-16 21:51 ` [PATCH 4.19 62/81] cifs: use cifsInodeInfo->open_file_lock while iterating to avoid a panic Greg Kroah-Hartman
2019-10-17 8:55 ` Pavel Machek
2019-10-17 16:01 ` Greg Kroah-Hartman
2019-10-17 17:19 ` Sasha Levin
2019-10-16 21:51 ` [PATCH 4.19 63/81] btrfs: fix incorrect updating of log root tree Greg Kroah-Hartman
2019-10-16 21:51 ` [PATCH 4.19 64/81] btrfs: fix uninitialized ret in ref-verify Greg Kroah-Hartman
2019-10-16 21:51 ` [PATCH 4.19 65/81] NFS: Fix O_DIRECT accounting of number of bytes read/written Greg Kroah-Hartman
2019-10-16 21:51 ` [PATCH 4.19 66/81] MIPS: Disable Loongson MMI instructions for kernel build Greg Kroah-Hartman
2020-08-26 21:06 ` Guenter Roeck
2020-09-03 9:26 ` Greg Kroah-Hartman
2020-09-07 3:35 ` Philippe Mathieu-Daudé
2020-09-24 13:54 ` Thomas Bogendoerfer
2019-10-16 21:51 ` [PATCH 4.19 67/81] MIPS: elf_hwcap: Export userspace ASEs Greg Kroah-Hartman
2019-10-16 21:51 ` [PATCH 4.19 68/81] ACPICA: ACPI 6.3: PPTT add additional fields in Processor Structure Flags Greg Kroah-Hartman
2019-10-17 8:59 ` Pavel Machek
2019-10-17 15:59 ` Greg Kroah-Hartman
2019-10-16 21:51 ` [PATCH 4.19 69/81] ACPI/PPTT: Add support for ACPI 6.3 thread flag Greg Kroah-Hartman
2019-10-16 21:51 ` [PATCH 4.19 70/81] arm64: topology: Use PPTT to determine if PE is a thread Greg Kroah-Hartman
2019-10-16 21:51 ` [PATCH 4.19 71/81] Fix the locking in dcache_readdir() and friends Greg Kroah-Hartman
2019-10-16 21:51 ` [PATCH 4.19 72/81] media: stkwebcam: fix runtime PM after driver unbind Greg Kroah-Hartman
2019-10-16 21:51 ` [PATCH 4.19 73/81] arm64/sve: Fix wrong free for task->thread.sve_state Greg Kroah-Hartman
2019-10-16 21:51 ` [PATCH 4.19 74/81] tracing/hwlat: Report total time spent in all NMIs during the sample Greg Kroah-Hartman
2019-10-16 21:51 ` [PATCH 4.19 75/81] tracing/hwlat: Dont ignore outer-loop duration when calculating max_latency Greg Kroah-Hartman
2019-10-16 21:51 ` [PATCH 4.19 76/81] ftrace: Get a reference counter for the trace_array on filter files Greg Kroah-Hartman
2019-10-16 21:51 ` [PATCH 4.19 77/81] tracing: Get trace_array reference for available_tracers files Greg Kroah-Hartman
2019-10-16 21:51 ` [PATCH 4.19 78/81] hwmon: Fix HWMON_P_MIN_ALARM mask Greg Kroah-Hartman
2019-10-16 21:51 ` [PATCH 4.19 79/81] x86/asm: Fix MWAITX C-state hint value Greg Kroah-Hartman
2019-10-16 21:51 ` [PATCH 4.19 80/81] PCI: vmd: Fix config addressing when using bus offsets Greg Kroah-Hartman
2019-10-16 21:51 ` [PATCH 4.19 81/81] perf/hw_breakpoint: Fix arch_hw_breakpoint use-before-initialization Greg Kroah-Hartman
2019-10-17 4:42 ` [PATCH 4.19 00/81] 4.19.80-stable review kernelci.org bot
2019-10-17 13:50 ` Naresh Kamboju
2019-10-17 15:02 ` shuah
2019-10-17 18:04 ` Guenter Roeck
2019-10-17 18:35 ` Didik Setiawan
2019-10-18 8:00 ` Jon Hunter
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20191016214821.983401763@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=johan@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).