lkml.org 
[lkml]   [2019]   [Oct]   [16]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.4 46/79] USB: chaoskey: fix use-after-free on release
    Date
    From: Johan Hovold <johan@kernel.org>

    commit 93ddb1f56ae102f14f9e46a9a9c8017faa970003 upstream.

    The driver was accessing its struct usb_interface in its release()
    callback without holding a reference. This would lead to a
    use-after-free whenever the device was disconnected while the character
    device was still open.

    Fixes: 66e3e591891d ("usb: Add driver for Altus Metrum ChaosKey device (v2)")
    Cc: stable <stable@vger.kernel.org> # 4.1
    Signed-off-by: Johan Hovold <johan@kernel.org>
    Link: https://lore.kernel.org/r/20191009153848.8664-3-johan@kernel.org
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    drivers/usb/misc/chaoskey.c | 5 +++--
    1 file changed, 3 insertions(+), 2 deletions(-)

    --- a/drivers/usb/misc/chaoskey.c
    +++ b/drivers/usb/misc/chaoskey.c
    @@ -96,6 +96,7 @@ static void chaoskey_free(struct chaoske
    usb_dbg(dev->interface, "free");
    kfree(dev->name);
    kfree(dev->buf);
    + usb_put_intf(dev->interface);
    kfree(dev);
    }

    @@ -144,6 +145,8 @@ static int chaoskey_probe(struct usb_int
    if (dev == NULL)
    return -ENOMEM;

    + dev->interface = usb_get_intf(interface);
    +
    dev->buf = kmalloc(size, GFP_KERNEL);

    if (dev->buf == NULL) {
    @@ -169,8 +172,6 @@ static int chaoskey_probe(struct usb_int
    strcat(dev->name, udev->serial);
    }

    - dev->interface = interface;
    -
    dev->in_ep = in_ep;

    dev->size = size;

    \
     
     \ /
      Last update: 2019-10-17 00:20    [W:7.924 / U:0.152 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site