From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Johan Hovold <johan@kernel.org>,
Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
Sasha Levin <sashal@kernel.org>,
linux-usb@vger.kernel.org
Subject: [PATCH AUTOSEL 4.4 19/21] USB: usb-skeleton: fix use-after-free after driver unbind
Date: Fri, 18 Oct 2019 18:10:05 -0400 [thread overview]
Message-ID: <20191018221007.10851-19-sashal@kernel.org> (raw)
In-Reply-To: <20191018221007.10851-1-sashal@kernel.org>
From: Johan Hovold <johan@kernel.org>
[ Upstream commit 6353001852776e7eeaab4da78922d4c6f2b076af ]
The driver failed to stop its read URB on disconnect, something which
could lead to a use-after-free in the completion handler after driver
unbind in case the character device has been closed.
Fixes: e7389cc9a7ff ("USB: skel_read really sucks royally")
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://lore.kernel.org/r/20191009170944.30057-3-johan@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/usb/usb-skeleton.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/usb/usb-skeleton.c b/drivers/usb/usb-skeleton.c
index 545d09b8081d5..be0fc67ce4f39 100644
--- a/drivers/usb/usb-skeleton.c
+++ b/drivers/usb/usb-skeleton.c
@@ -593,6 +593,7 @@ static void skel_disconnect(struct usb_interface *interface)
dev->interface = NULL;
mutex_unlock(&dev->io_mutex);
+ usb_kill_urb(dev->bulk_in_urb);
usb_kill_anchored_urbs(&dev->submitted);
/* decrement our usage count */
--
2.20.1
next prev parent reply other threads:[~2019-10-18 22:11 UTC|newest]
Thread overview: 21+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-10-18 22:09 [PATCH AUTOSEL 4.4 01/21] sc16is7xx: Fix for "Unexpected interrupt: 8" Sasha Levin
2019-10-18 22:09 ` [PATCH AUTOSEL 4.4 02/21] x86/cpu: Add Atom Tremont (Jacobsville) Sasha Levin
2019-10-18 22:09 ` [PATCH AUTOSEL 4.4 03/21] scripts/setlocalversion: Improve -dirty check with git-status --no-optional-locks Sasha Levin
2019-10-18 22:09 ` [PATCH AUTOSEL 4.4 04/21] usb: handle warm-reset port requests on hub resume Sasha Levin
2019-10-18 22:09 ` [PATCH AUTOSEL 4.4 05/21] exec: load_script: Do not exec truncated interpreter path Sasha Levin
2019-10-18 22:09 ` [PATCH AUTOSEL 4.4 06/21] iio: fix center temperature of bmc150-accel-core Sasha Levin
2019-10-18 22:09 ` [PATCH AUTOSEL 4.4 07/21] perf map: Fix overlapped map handling Sasha Levin
2019-10-18 22:09 ` [PATCH AUTOSEL 4.4 08/21] RDMA/iwcm: Fix a lock inversion issue Sasha Levin
2019-10-18 22:09 ` [PATCH AUTOSEL 4.4 09/21] nfs: Fix nfsi->nrequests count error on nfs_inode_remove_request Sasha Levin
2019-10-18 22:09 ` [PATCH AUTOSEL 4.4 10/21] fs: cifs: mute -Wunused-const-variable message Sasha Levin
2019-10-18 22:09 ` [PATCH AUTOSEL 4.4 11/21] serial: mctrl_gpio: Check for NULL pointer Sasha Levin
2019-10-18 22:09 ` [PATCH AUTOSEL 4.4 12/21] efi/cper: Fix endianness of PCIe class code Sasha Levin
2019-10-18 22:09 ` [PATCH AUTOSEL 4.4 13/21] efi/x86: Do not clean dummy variable in kexec path Sasha Levin
2019-10-18 22:10 ` [PATCH AUTOSEL 4.4 14/21] fs: ocfs2: fix possible null-pointer dereferences in ocfs2_xa_prepare_entry() Sasha Levin
2019-10-18 22:10 ` [PATCH AUTOSEL 4.4 15/21] fs: ocfs2: fix a possible null-pointer dereference in ocfs2_info_scan_inode_alloc() Sasha Levin
2019-10-18 22:10 ` [PATCH AUTOSEL 4.4 16/21] iio: adc: ad799x: fix probe error handling Sasha Levin
2019-10-18 22:10 ` [PATCH AUTOSEL 4.4 17/21] iio: light: opt3001: fix mutex unlock race Sasha Levin
2019-10-18 22:10 ` [PATCH AUTOSEL 4.4 18/21] MIPS: fw: sni: Fix out of bounds init of o32 stack Sasha Levin
2019-10-18 22:10 ` Sasha Levin [this message]
2019-10-18 22:10 ` [PATCH AUTOSEL 4.4 20/21] NFSv4: Fix leak of clp->cl_acceptor string Sasha Levin
2019-10-18 22:10 ` [PATCH AUTOSEL 4.4 21/21] tracing: Initialize iter->seq after zeroing in tracing_read_pipe() Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20191018221007.10851-19-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=gregkh@linuxfoundation.org \
--cc=johan@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-usb@vger.kernel.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.