linux-stable/drivers/hid
Oliver Neukum 69626f23bc HID: fix race between open() and disconnect() in usbhid
There is a window:

task A					task B
spin_lock_irq(&usbhid->inlock);	/* Sync with error handler */
usb_set_intfdata(intf, NULL);
spin_unlock_irq(&usbhid->inlock);
usb_kill_urb(usbhid->urbin);
usb_kill_urb(usbhid->urbout);
usb_kill_urb(usbhid->urbctrl);

del_timer_sync(&usbhid->io_retry);
cancel_work_sync(&usbhid->reset_work);

						if (!hid->open++) {
							res = usb_autopm_get_interface(usbhid->intf);
							if (res < 0) {
								hid->open--;
								return -EIO;
							}
						}
						if (hid_start_in(hid))

if (hid->claimed & HID_CLAIMED_INPUT)
	hidinput_disconnect(hid);

in which an open() to an already disconnected device will submit an URB
to an undead device. In case disconnect() was called by an ioctl, this'll
oops. Fix by introducing a new flag and checking it in hid_start_in().

Signed-off-by: Oliver Neukum <oneukum@suse.de>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
2008-04-22 11:34:58 +02:00
..
usbhid HID: fix race between open() and disconnect() in usbhid 2008-04-22 11:34:58 +02:00
hid-core.c HID: make hid_input_field and usbhid_modify_dquirk static 2008-04-22 11:34:58 +02:00
hid-debug.c HID: only dump report traffic with debug level 2 2008-04-22 11:34:57 +02:00
hid-input-quirks.c HID: fix sparse warnings 2008-04-22 11:34:57 +02:00
hid-input.c HID: update key codes for Apple aluminium 2008-03-18 11:20:33 +01:00
hidraw.c Use helpers to obtain task pid in printks 2007-10-19 11:53:43 -07:00
Kconfig HID: add hidraw interface 2007-10-14 14:47:26 +02:00
Makefile HID: refactor mapping to input subsystem for quirky devices 2008-01-28 14:51:20 +01:00