From: Johan Hovold <johan@kernel.org>
To: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Oliver Neukum <oneukum@suse.com>,
Valentin Vidic <vvidic@valentin-vidic.from.hr>,
linux-usb@vger.kernel.org, linux-kernel@vger.kernel.org,
Johan Hovold <johan@kernel.org>
Subject: [PATCH 0/6] USB: iowarrior: disconnect fixes and locking cleanups
Date: Wed, 9 Oct 2019 12:48:40 +0200 [thread overview]
Message-ID: <20191009104846.5925-1-johan@kernel.org> (raw)
This series fixes a use-after-free bug introduced by a recent
disconnect-deadlock fix that was reported by syzbot. Turns out there was
already a related bug in the driver, and the first patch addresses both
issues.
While looking at the code I found two more use-after-free bugs, which
the next two patches fix.
The next two clean up the driver by dropping two redundant locks.
Tested using a mockup device.
Johan
Johan Hovold (6):
USB: iowarrior: fix use-after-free on disconnect
USB: iowarrior: fix use-after-free on release
USB: iowarrior: fix use-after-free after driver unbind
USB: iowarrior: drop redundant disconnect mutex
USB: iowarrior: drop redundant iowarrior mutex
USB: iowarrior: use pr_err()
drivers/usb/misc/iowarrior.c | 48 +++++++++++-------------------------
1 file changed, 15 insertions(+), 33 deletions(-)
--
2.23.0
next reply other threads:[~2019-10-09 10:49 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-10-09 10:48 Johan Hovold [this message]
2019-10-09 10:48 ` [PATCH 1/6] USB: iowarrior: fix use-after-free on disconnect Johan Hovold
2019-10-09 10:48 ` [PATCH 2/6] USB: iowarrior: fix use-after-free on release Johan Hovold
2019-10-09 10:48 ` [PATCH 3/6] USB: iowarrior: fix use-after-free after driver unbind Johan Hovold
2019-10-09 10:48 ` [PATCH 4/6] USB: iowarrior: drop redundant disconnect mutex Johan Hovold
2019-10-09 10:48 ` [PATCH 5/6] USB: iowarrior: drop redundant iowarrior mutex Johan Hovold
2019-10-09 10:48 ` [PATCH 6/6] USB: iowarrior: use pr_err() Johan Hovold
2019-10-10 10:45 ` [PATCH 0/6] USB: iowarrior: disconnect fixes and locking cleanups Greg Kroah-Hartman
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20191009104846.5925-1-johan@kernel.org \
--to=johan@kernel.org \
--cc=gregkh@linuxfoundation.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-usb@vger.kernel.org \
--cc=oneukum@suse.com \
--cc=vvidic@valentin-vidic.from.hr \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.