Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit c2d284ee authored by Russ Dill's avatar Russ Dill Committed by Greg Kroah-Hartman
Browse files

USB: Close usb_find_interface race v3 



USB drivers that create character devices call usb_register_dev in their
probe function. This associates the usb_interface device with that minor
number and creates the character device and announces it to the world.
However, the driver's probe function is called before the new
usb_interface is added to the driver's klist_devices.

This is a problem because userspace will respond to the character device
creation announcement by opening the character device. The driver's open
function will the call usb_find_interface to find the usb_interface
associated with that minor number. usb_find_interface will walk the
driver's list of devices and find the usb_interface with the matching
minor number.

Because the announcement happens before the usb_interface is added to the
driver's klist_devices, a race condition exists. A straightforward fix
is to walk the list of devices on usb_bus_type instead since the device
is added to that list before the announcement occurs.

bus_find_device calls get_device to bump the reference count on the found
device. It is arguable that the reference count should be dropped by the
caller of usb_find_interface instead of usb_find_interface, however,
the current users of usb_find_interface do not expect this.

The original version of this patch only matched against minor number
instead of driver and minor number. This version matches against both.

Signed-off-by: default avatarRuss Dill <Russ.Dill@gmail.com>
Cc: stable <stable@kernel.org>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@suse.de>
parent ab7cd8c7

drivers/usb/core/usb.c

+16 −15
Original line number Diff line number Diff line
@@ -169,7 +169,7 @@ EXPORT_SYMBOL_GPL(usb_altnum_to_altsetting); 


struct find_interface_arg {

	int minor;

	struct usb_interface *interface;

	struct device_driver *drv;

};



static int __find_interface(struct device *dev, void *data)
@@ -180,12 +180,10 @@ static int __find_interface(struct device *dev, void *data) 
	if (!is_usb_interface(dev))

		return 0;



	intf = to_usb_interface(dev);

	if (intf->minor != -1 && intf->minor == arg->minor) {

		arg->interface = intf;

		return 1;

	}

	if (dev->driver != arg->drv)

		return 0;

	intf = to_usb_interface(dev);

	return intf->minor == arg->minor;

}



/**
@@ -193,21 +191,24 @@ static int __find_interface(struct device *dev, void *data) 
 * @drv: the driver whose current configuration is considered

 * @minor: the minor number of the desired device

 *

 * This walks the driver device list and returns a pointer to the interface

 * with the matching minor.  Note, this only works for devices that share the

 * USB major number.

 * This walks the bus device list and returns a pointer to the interface

 * with the matching minor and driver.  Note, this only works for devices

 * that share the USB major number.

 */

struct usb_interface *usb_find_interface(struct usb_driver *drv, int minor)

{

	struct find_interface_arg argb;

	int retval;

	struct device *dev;



	argb.minor = minor;

	argb.interface = NULL;

	/* eat the error, it will be in argb.interface */

	retval = driver_for_each_device(&drv->drvwrap.driver, NULL, &argb,

					__find_interface);

	return argb.interface;

	argb.drv = &drv->drvwrap.driver;



	dev = bus_find_device(&usb_bus_type, NULL, &argb, __find_interface);



	/* Drop reference count from bus_find_device */

	put_device(dev);



	return dev ? to_usb_interface(dev) : NULL;

}

EXPORT_SYMBOL_GPL(usb_find_interface);