]> git.proxmox.com Git - mirror_ubuntu-kernels.git/commit
HID: usbhid: Fix race between usbhid_close() and usbhid_stop()
authorAlan Stern <stern@rowland.harvard.edu>
Wed, 22 Apr 2020 20:18:48 +0000 (16:18 -0400)
committerJiri Kosina <jkosina@suse.cz>
Wed, 29 Apr 2020 14:24:26 +0000 (16:24 +0200)
commit0ed08faded1da03eb3def61502b27f81aef2e615
tree35b05447dc4293e0a4c29368253c432d8e071048
parentb43f977dd281945960c26b3ef67bba0fa07d39d9
HID: usbhid: Fix race between usbhid_close() and usbhid_stop()

The syzbot fuzzer discovered a bad race between in the usbhid driver
between usbhid_stop() and usbhid_close().  In particular,
usbhid_stop() does:

usb_free_urb(usbhid->urbin);
...
usbhid->urbin = NULL; /* don't mess up next start */

and usbhid_close() does:

usb_kill_urb(usbhid->urbin);

with no mutual exclusion.  If the two routines happen to run
concurrently so that usb_kill_urb() is called in between the
usb_free_urb() and the NULL assignment, it will access the
deallocated urb structure -- a use-after-free bug.

This patch adds a mutex to the usbhid private structure and uses it to
enforce mutual exclusion of the usbhid_start(), usbhid_stop(),
usbhid_open() and usbhid_close() callbacks.

Reported-and-tested-by: syzbot+7bf5a7b0f0a1f9446f4c@syzkaller.appspotmail.com
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
CC: <stable@vger.kernel.org>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
drivers/hid/usbhid/hid-core.c
drivers/hid/usbhid/usbhid.h