Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit d397091d authored by Oliver Neukum's avatar Oliver Neukum Committed by Greg Kroah-Hartman
Browse files

usb: iowarrior: fix deadlock on disconnect 



commit c468a8aa790e0dfe0a7f8a39db282d39c2c00b46 upstream.

We have to drop the mutex before we close() upon disconnect()
as close() needs the lock. This is safe to do by dropping the
mutex as intfdata is already set to NULL, so open() will fail.

Fixes: 03f36e88 ("USB: open disconnect race in iowarrior")
Reported-by: default avatar <syzbot+a64a382964bf6c71a9c0@syzkaller.appspotmail.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: default avatarOliver Neukum <oneukum@suse.com>
Link: https://lore.kernel.org/r/20190808092728.23417-1-oneukum@suse.com


Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent b43611cd

drivers/usb/misc/iowarrior.c

+4 −3
Original line number Diff line number Diff line
@@ -866,19 +866,20 @@ static void iowarrior_disconnect(struct usb_interface *interface) 
	dev = usb_get_intfdata(interface);

	mutex_lock(&iowarrior_open_disc_lock);

	usb_set_intfdata(interface, NULL);

	/* prevent device read, write and ioctl */

	dev->present = 0;



	minor = dev->minor;

	mutex_unlock(&iowarrior_open_disc_lock);

	/* give back our minor - this will call close() locks need to be dropped at this point*/



	/* give back our minor */

	usb_deregister_dev(interface, &iowarrior_class);



	mutex_lock(&dev->mutex);



	/* prevent device read, write and ioctl */

	dev->present = 0;



	mutex_unlock(&dev->mutex);

	mutex_unlock(&iowarrior_open_disc_lock);



	if (dev->opened) {

		/* There is a process that holds a filedescriptor to the device ,