[patch]disconnect open race in legousbtower

Hi,

again, possible use after free due to touching intfdata without lock.

	Regards
		Oliver

Signed-off-by: Oliver Neukum <[email protected]>

----

--- linux-2.6.24-rc1/drivers/usb/misc/legousbtower.c.alt	2007-10-25 15:25:08.000000000 +0200
+++ linux-2.6.24-rc1/drivers/usb/misc/legousbtower.c	2007-10-25 15:25:18.000000000 +0200
@@ -198,6 +198,7 @@ static struct usb_device_id tower_table 
 };
 
 MODULE_DEVICE_TABLE (usb, tower_table);
+static DEFINE_MUTEX(open_disc_mutex);
 
 #define LEGO_USB_TOWER_MINOR_BASE	160
 
@@ -350,25 +351,31 @@ static int tower_open (struct inode *ino
 		goto exit;
 	}
 
+	mutex_lock(&open_disc_mutex);
 	dev = usb_get_intfdata(interface);
 
 	if (!dev) {
+		mutex_unlock(&open_disc_mutex);
 		retval = -ENODEV;
 		goto exit;
 	}
 
 	/* lock this device */
 	if (down_interruptible (&dev->sem)) {
+		mutex_unlock(&open_disc_mutex);
 	        retval = -ERESTARTSYS;
 		goto exit;
 	}
+	
 
 	/* allow opening only once */
 	if (dev->open_count) {
+		mutex_unlock(&open_disc_mutex);
 		retval = -EBUSY;
 		goto unlock_exit;
 	}
 	dev->open_count = 1;
+	mutex_unlock(&open_disc_mutex);
 
 	/* reset the tower */
 	result = usb_control_msg (dev->udev,
@@ -437,9 +444,10 @@ static int tower_release (struct inode *
 	if (dev == NULL) {
 		dbg(1, "%s: object is NULL", __FUNCTION__);
 		retval = -ENODEV;
-		goto exit;
+		goto exit_nolock;
 	}
 
+	mutex_lock(&open_disc_mutex);
 	if (down_interruptible (&dev->sem)) {
 	        retval = -ERESTARTSYS;
 		goto exit;
@@ -468,6 +476,8 @@ unlock_exit:
 	up (&dev->sem);
 
 exit:
+	mutex_unlock(&open_disc_mutex);
+exit_nolock:
 	dbg(2, "%s: leave, return value %d", __FUNCTION__, retval);
 	return retval;
 }
@@ -989,6 +999,7 @@ static void tower_disconnect (struct usb
 	dbg(2, "%s: enter", __FUNCTION__);
 
 	dev = usb_get_intfdata (interface);
+	mutex_lock(&open_disc_mutex);
 	usb_set_intfdata (interface, NULL);
 
 	minor = dev->minor;
@@ -997,6 +1008,7 @@ static void tower_disconnect (struct usb
 	usb_deregister_dev (interface, &tower_class);
 
 	down (&dev->sem);
+	mutex_unlock(&open_disc_mutex);
 
 	/* if the device is not opened, then we clean up right now */
 	if (!dev->open_count) {

-------------------------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems?  Stop.
Now Search log events and configuration files using AJAX and a browser.
Download your FREE copy of Splunk now >> http://get.splunk.com/
_______________________________________________
[email protected]
To unsubscribe, use the last form field at:
https://lists.sourceforge.net/lists/listinfo/linux-usb-devel