Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 24956f26 authored by Hemant Kumar's avatar Hemant Kumar
Browse files

usb: core: Fix use after free for hub usb device 



There is a possibility of root hub usb device being
freed as part of controller driver unbind and hub
thread trying to access root hub usb device. Hence
increment the usb device reference count before
accessing it by hub thread.

CRs-Fixed: 671581
Change-Id: Icf1297452e55a4ca0acd67075320f7a32929a1b3
Signed-off-by: default avatarHemant Kumar <hemantk@codeaurora.org>
parent e1b6fe17

drivers/usb/core/hub.c

+10 −0
Original line number Diff line number Diff line
@@ -4751,6 +4751,14 @@ static void hub_events(void) 


		hub = list_entry(tmp, struct usb_hub, event_list);

		kref_get(&hub->kref);



		/* make sure hdev is not freed before accessing it */

		if (hub->disconnected) {

			spin_unlock_irq(&hub_event_lock);

			goto hub_disconnected;

		} else {

			usb_get_dev(hub->hdev);

		}

		spin_unlock_irq(&hub_event_lock);



		hdev = hub->hdev;
@@ -4968,6 +4976,8 @@ static void hub_events(void) 
		usb_autopm_put_interface(intf);

 loop_disconnected:

		usb_unlock_device(hdev);

		usb_put_dev(hdev);

 hub_disconnected:

		kref_put(&hub->kref, hub_release);



        } /* end while (1) */