Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 75dd211e authored by Johan Hovold's avatar Johan Hovold
Browse files

USB: serial: mos7720: fix parport use-after-free on probe errors 



Do not submit the interrupt URB until after the parport has been
successfully registered to avoid another use-after-free in the
completion handler when accessing the freed parport private data in case
of a racing completion.

Fixes: b69578df ("USB: usbserial: mos7720: add support for parallel
port on moschip 7715")
Cc: stable <stable@vger.kernel.org>
Signed-off-by: default avatarJohan Hovold <johan@kernel.org>
parent 91a1ff4d

drivers/usb/serial/mos7720.c

+8 −10
Original line number Original line Diff line number Diff line
@@ -1952,22 +1952,20 @@ static int mos7720_startup(struct usb_serial *serial) 
	usb_control_msg(serial->dev, usb_sndctrlpipe(serial->dev, 0),

	usb_control_msg(serial->dev, usb_sndctrlpipe(serial->dev, 0),

			(__u8)0x03, 0x00, 0x01, 0x00, NULL, 0x00, 5000);

			(__u8)0x03, 0x00, 0x01, 0x00, NULL, 0x00, 5000);





	/* start the interrupt urb */

	ret_val = usb_submit_urb(serial->port[0]->interrupt_in_urb, GFP_KERNEL);

	if (ret_val)

		dev_err(&dev->dev,

			"%s - Error %d submitting control urb\n",

			__func__, ret_val);



#ifdef CONFIG_USB_SERIAL_MOS7715_PARPORT

#ifdef CONFIG_USB_SERIAL_MOS7715_PARPORT

	if (product == MOSCHIP_DEVICE_ID_7715) {

	if (product == MOSCHIP_DEVICE_ID_7715) {

		ret_val = mos7715_parport_init(serial);

		ret_val = mos7715_parport_init(serial);

		if (ret_val < 0) {

		if (ret_val < 0)

			usb_kill_urb(serial->port[0]->interrupt_in_urb);

			return ret_val;

			return ret_val;

	}

	}

	}

#endif

#endif

	/* start the interrupt urb */

	ret_val = usb_submit_urb(serial->port[0]->interrupt_in_urb, GFP_KERNEL);

	if (ret_val) {

		dev_err(&dev->dev, "failed to submit interrupt urb: %d\n",

			ret_val);

	}



	/* LSR For Port 1 */

	/* LSR For Port 1 */

	read_mos_reg(serial, 0, MOS7720_LSR, &data);

	read_mos_reg(serial, 0, MOS7720_LSR, &data);

	dev_dbg(&dev->dev, "LSR:%x\n", data);

	dev_dbg(&dev->dev, "LSR:%x\n", data);