diff options
| author | Johan Hovold <johan@kernel.org> | 2021-03-22 16:53:12 +0100 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2021-04-07 12:04:22 +0200 |
| commit | 1f39a43e67cff4b84b8549133f696f7ba475b1d7 (patch) | |
| tree | b4a0c9680d2a37e1abc5acac796c3ae562821379 | |
| parent | 8e422c16d35206b05e9ea970708c6f2aaed5e261 (diff) | |
| download | linux-1f39a43e67cff4b84b8549133f696f7ba475b1d7.tar.gz linux-1f39a43e67cff4b84b8549133f696f7ba475b1d7.tar.bz2 linux-1f39a43e67cff4b84b8549133f696f7ba475b1d7.zip | |
USB: cdc-acm: fix use-after-free after probe failure
commit 4e49bf376c0451ad2eae2592e093659cde12be9a upstream.
If tty-device registration fails the driver would fail to release the
data interface. When the device is later disconnected, the disconnect
callback would still be called for the data interface and would go about
releasing already freed resources.
Fixes: c93d81955005 ("usb: cdc-acm: fix error handling in acm_probe()")
Cc: stable@vger.kernel.org # 3.9
Cc: Alexey Khoroshilov <khoroshilov@ispras.ru>
Acked-by: Oliver Neukum <oneukum@suse.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://lore.kernel.org/r/20210322155318.9837-3-johan@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| -rw-r--r-- | drivers/usb/class/cdc-acm.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c index 130153392c2c..8c476a785360 100644 --- a/drivers/usb/class/cdc-acm.c +++ b/drivers/usb/class/cdc-acm.c @@ -1502,6 +1502,11 @@ skip_countries: return 0; alloc_fail8: + if (!acm->combined_interfaces) { + /* Clear driver data so that disconnect() returns early. */ + usb_set_intfdata(data_interface, NULL); + usb_driver_release_interface(&acm_driver, data_interface); + } if (acm->country_codes) { device_remove_file(&acm->control->dev, &dev_attr_wCountryCodes); |