Commit 78663ecc authored by Oliver Neukum's avatar Oliver Neukum Committed by Greg Kroah-Hartman

USB: disconnect open race in legousbtower

again, possible use after free due to touching intfdata without lock.
Signed-off-by: default avatarOliver Neukum <oneukum@suse.de>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@suse.de>
parent 03f36e88
...@@ -198,6 +198,7 @@ static struct usb_device_id tower_table [] = { ...@@ -198,6 +198,7 @@ static struct usb_device_id tower_table [] = {
}; };
MODULE_DEVICE_TABLE (usb, tower_table); MODULE_DEVICE_TABLE (usb, tower_table);
static DEFINE_MUTEX(open_disc_mutex);
#define LEGO_USB_TOWER_MINOR_BASE 160 #define LEGO_USB_TOWER_MINOR_BASE 160
...@@ -350,25 +351,31 @@ static int tower_open (struct inode *inode, struct file *file) ...@@ -350,25 +351,31 @@ static int tower_open (struct inode *inode, struct file *file)
goto exit; goto exit;
} }
mutex_lock(&open_disc_mutex);
dev = usb_get_intfdata(interface); dev = usb_get_intfdata(interface);
if (!dev) { if (!dev) {
mutex_unlock(&open_disc_mutex);
retval = -ENODEV; retval = -ENODEV;
goto exit; goto exit;
} }
/* lock this device */ /* lock this device */
if (down_interruptible (&dev->sem)) { if (down_interruptible (&dev->sem)) {
mutex_unlock(&open_disc_mutex);
retval = -ERESTARTSYS; retval = -ERESTARTSYS;
goto exit; goto exit;
} }
/* allow opening only once */ /* allow opening only once */
if (dev->open_count) { if (dev->open_count) {
mutex_unlock(&open_disc_mutex);
retval = -EBUSY; retval = -EBUSY;
goto unlock_exit; goto unlock_exit;
} }
dev->open_count = 1; dev->open_count = 1;
mutex_unlock(&open_disc_mutex);
/* reset the tower */ /* reset the tower */
result = usb_control_msg (dev->udev, result = usb_control_msg (dev->udev,
...@@ -437,9 +444,10 @@ static int tower_release (struct inode *inode, struct file *file) ...@@ -437,9 +444,10 @@ static int tower_release (struct inode *inode, struct file *file)
if (dev == NULL) { if (dev == NULL) {
dbg(1, "%s: object is NULL", __FUNCTION__); dbg(1, "%s: object is NULL", __FUNCTION__);
retval = -ENODEV; retval = -ENODEV;
goto exit; goto exit_nolock;
} }
mutex_lock(&open_disc_mutex);
if (down_interruptible (&dev->sem)) { if (down_interruptible (&dev->sem)) {
retval = -ERESTARTSYS; retval = -ERESTARTSYS;
goto exit; goto exit;
...@@ -468,6 +476,8 @@ unlock_exit: ...@@ -468,6 +476,8 @@ unlock_exit:
up (&dev->sem); up (&dev->sem);
exit: exit:
mutex_unlock(&open_disc_mutex);
exit_nolock:
dbg(2, "%s: leave, return value %d", __FUNCTION__, retval); dbg(2, "%s: leave, return value %d", __FUNCTION__, retval);
return retval; return retval;
} }
...@@ -989,6 +999,7 @@ static void tower_disconnect (struct usb_interface *interface) ...@@ -989,6 +999,7 @@ static void tower_disconnect (struct usb_interface *interface)
dbg(2, "%s: enter", __FUNCTION__); dbg(2, "%s: enter", __FUNCTION__);
dev = usb_get_intfdata (interface); dev = usb_get_intfdata (interface);
mutex_lock(&open_disc_mutex);
usb_set_intfdata (interface, NULL); usb_set_intfdata (interface, NULL);
minor = dev->minor; minor = dev->minor;
...@@ -997,6 +1008,7 @@ static void tower_disconnect (struct usb_interface *interface) ...@@ -997,6 +1008,7 @@ static void tower_disconnect (struct usb_interface *interface)
usb_deregister_dev (interface, &tower_class); usb_deregister_dev (interface, &tower_class);
down (&dev->sem); down (&dev->sem);
mutex_unlock(&open_disc_mutex);
/* if the device is not opened, then we clean up right now */ /* if the device is not opened, then we clean up right now */
if (!dev->open_count) { if (!dev->open_count) {
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment