1
0
Fork 0
alistair23-linux/drivers/usb/class
Oliver Neukum 1426bd2c9f USB: cdc-wdm: fix race between write and disconnect due to flag abuse
In case of a disconnect an ongoing flush() has to be made fail.
Nevertheless we cannot be sure that any pending URB has already
finished, so although they will never succeed, they still must
not be touched.
The clean solution for this is to check for WDM_IN_USE
and WDM_DISCONNECTED in flush(). There is no point in ever
clearing WDM_IN_USE, as no further writes make sense.

The issue is as old as the driver.

Fixes: afba937e54 ("USB: CDC WDM driver")
Reported-by: syzbot+d232cca6ec42c2edb3fc@syzkaller.appspotmail.com
Signed-off-by: Oliver Neukum <oneukum@suse.com>
Cc: stable <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20190827103436.21143-1-oneukum@suse.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-08-28 22:48:38 +02:00
..
Kconfig docs: usb: rename files to .rst and add them to drivers-api 2019-06-20 14:28:36 +02:00
Makefile USB: add SPDX identifiers to all remaining Makefiles 2017-11-07 15:53:48 +01:00
cdc-acm.c usb: cdc-acm: make sure a refcount is taken early enough 2019-08-15 14:49:16 +02:00
cdc-acm.h USB: cdc-acm: clean up throttle handling 2019-04-29 16:14:41 +02:00
cdc-wdm.c USB: cdc-wdm: fix race between write and disconnect due to flag abuse 2019-08-28 22:48:38 +02:00
usblp.c usb: usblp: use irqsave() in USB's complete callback 2018-06-28 19:36:06 +09:00
usbtmc.c usbtmc: more sanity checking for packet size 2019-08-21 09:45:46 -07:00