Eric Lee / smarc-ti-linux-kernel

Download as
Browse Code ยป

Commit c0b572be507563e379a8c102b1bba57d18db26ef

Authored by Johan Hovold
Committed by Greg Kroah-Hartman
1 parent 40f9ca60c5
Exists in smarct4x-processor-sdk-linux-03.00.00.04 and in 2 other branches dlt-processor-sdk-linux-03.00.00.04, smarct3x-processor-sdk-linux-03.00.00.04

USB: serial: mxuport: fix use-after-free in probe error path 

commit 9e45284984096314994777f27e1446dfbfd2f0d7 upstream.

The interface read and event URBs are submitted in attach, but were
never explicitly unlinked by the driver. Instead the URBs would have
been killed by usb-serial core on disconnect.

In case of a late probe error (e.g. due to failed minor allocation),
disconnect is never called and we could end up with active URBs for an
unbound interface. This in turn could lead to deallocated memory being
dereferenced in the completion callbacks.

Fixes: ee467a1f2066 ("USB: serial: add Moxa UPORT 12XX/14XX/16XX
driver")
Signed-off-by: Johan Hovold <johan@kernel.org>
Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Showing 1 changed file with 10 additions and 0 deletions Side-by-side Diff

drivers/usb/serial/mxuport.c
Diff comments   View file @ c0b572b
... ... @@ -1259,6 +1259,15 @@
1259 1259 return 0;
1260 1260 }
1261 1261  
  1262 +static void mxuport_release(struct usb_serial *serial)
  1263 +{
  1264 + struct usb_serial_port *port0 = serial->port[0];
  1265 + struct usb_serial_port *port1 = serial->port[1];
  1266 +
  1267 + usb_serial_generic_close(port1);
  1268 + usb_serial_generic_close(port0);
  1269 +}
  1270 +
1262 1271 static int mxuport_open(struct tty_struct *tty, struct usb_serial_port *port)
1263 1272 {
1264 1273 struct mxuport_port *mxport = usb_get_serial_port_data(port);
... ... @@ -1361,6 +1370,7 @@
1361 1370 .probe = mxuport_probe,
1362 1371 .port_probe = mxuport_port_probe,
1363 1372 .attach = mxuport_attach,
  1373 + .release = mxuport_release,
1364 1374 .calc_num_ports = mxuport_calc_num_ports,
1365 1375 .open = mxuport_open,
1366 1376 .close = mxuport_close,