mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-29 13:53:33 +00:00
USB: legousbtower: fix use-after-free on release
commit726b55d0e2
upstream. The driver was accessing its struct usb_device in its release() callback without holding a reference. This would lead to a use-after-free whenever the device was disconnected while the character device was still open. Fixes:fef526cae7
("USB: legousbtower: remove custom debug macro") Cc: stable <stable@vger.kernel.org> # 3.12 Signed-off-by: Johan Hovold <johan@kernel.org> Link: https://lore.kernel.org/r/20191009153848.8664-5-johan@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
parent
2f24387c1d
commit
5f5264e0d7
1 changed files with 2 additions and 1 deletions
|
@ -300,6 +300,7 @@ static inline void tower_delete (struct lego_usb_tower *dev)
|
|||
kfree (dev->read_buffer);
|
||||
kfree (dev->interrupt_in_buffer);
|
||||
kfree (dev->interrupt_out_buffer);
|
||||
usb_put_dev(dev->udev);
|
||||
kfree (dev);
|
||||
}
|
||||
|
||||
|
@ -813,7 +814,7 @@ static int tower_probe (struct usb_interface *interface, const struct usb_device
|
|||
|
||||
mutex_init(&dev->lock);
|
||||
|
||||
dev->udev = udev;
|
||||
dev->udev = usb_get_dev(udev);
|
||||
dev->open_count = 0;
|
||||
dev->disconnected = 0;
|
||||
|
||||
|
|
Loading…
Reference in a new issue