]> git.proxmox.com Git - mirror_ubuntu-bionic-kernel.git/commit
USB: iowarrior: fix use-after-free on release
authorJohan Hovold <johan@kernel.org>
Wed, 9 Oct 2019 10:48:42 +0000 (12:48 +0200)
committerStefan Bader <stefan.bader@canonical.com>
Tue, 12 Nov 2019 18:04:32 +0000 (19:04 +0100)
commitf2c16c8068ca4bf1a64070ad1245625f314ddddd
tree5787dd771da3c7939d96a7d78c4575a3efeee131
parente03b0c4a6e0684b29e416c0a19e6837047824545
USB: iowarrior: fix use-after-free on release

BugLink: https://bugs.launchpad.net/bugs/1850541
commit 80cd5479b525093a56ef768553045741af61b250 upstream.

The driver was accessing its struct usb_interface from its release()
callback without holding a reference. This would lead to a
use-after-free whenever debugging was enabled and the device was
disconnected while its character device was open.

Fixes: 549e83500b80 ("USB: iowarrior: Convert local dbg macro to dev_dbg")
Cc: stable <stable@vger.kernel.org> # 3.16
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://lore.kernel.org/r/20191009104846.5925-3-johan@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
Signed-off-by: Kleber Sacilotto de Souza <kleber.souza@canonical.com>
drivers/usb/misc/iowarrior.c