Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit c9919790 authored by Alan Stern's avatar Alan Stern Committed by Greg Kroah-Hartman
Browse files

USB: fix use-after-free bug in usb_hcd_unlink_urb() 



The usb_hcd_unlink_urb() routine in hcd.c contains two possible
use-after-free errors.  The dev_dbg() statement at the end of the
routine dereferences urb and urb->dev even though both structures may
have been deallocated.

This patch fixes the problem by storing urb->dev in a local variable
(avoiding the dereference of urb) and moving the dev_dbg() up before
the usb_put_dev() call.

Signed-off-by: default avatarAlan Stern <stern@rowland.harvard.edu>
Reported-by: default avatarJoe Lawrence <joe.lawrence@stratus.com>
Tested-by: default avatarJoe Lawrence <joe.lawrence@stratus.com>
CC: <stable@vger.kernel.org>
Signed-off-by: default avatarGreg Kroah-Hartman <greg@kroah.com>
parent cefa9a31

drivers/usb/core/hcd.c

+8 −8
Original line number Diff line number Diff line
@@ -1618,6 +1618,7 @@ static int unlink1(struct usb_hcd *hcd, struct urb *urb, int status) 
int usb_hcd_unlink_urb (struct urb *urb, int status)

{

	struct usb_hcd		*hcd;

	struct usb_device	*udev = urb->dev;

	int			retval = -EIDRM;

	unsigned long		flags;
@@ -1629,20 +1630,19 @@ int usb_hcd_unlink_urb (struct urb *urb, int status) 
	spin_lock_irqsave(&hcd_urb_unlink_lock, flags);

	if (atomic_read(&urb->use_count) > 0) {

		retval = 0;

		usb_get_dev(urb->dev);

		usb_get_dev(udev);

	}

	spin_unlock_irqrestore(&hcd_urb_unlink_lock, flags);

	if (retval == 0) {

		hcd = bus_to_hcd(urb->dev->bus);

		retval = unlink1(hcd, urb, status);

		usb_put_dev(urb->dev);

	}



		if (retval == 0)

			retval = -EINPROGRESS;

		else if (retval != -EIDRM && retval != -EBUSY)

		dev_dbg(&urb->dev->dev, "hcd_unlink_urb %p fail %d\n",

			dev_dbg(&udev->dev, "hcd_unlink_urb %p fail %d\n",

					urb, retval);

		usb_put_dev(udev);

	}

	return retval;

}