diff mbox series

[2/7] USB: cdc-acm: fix use-after-free after probe failure

Message ID 20210318155202.22230-3-johan@kernel.org
State Superseded
Headers show
Series USB: cdc-acm: probe fixes | expand

Commit Message

Johan Hovold March 18, 2021, 3:51 p.m. UTC 
If tty-device registration fails the driver would fail to release the
data interface. When the device is later disconnected, the disconnect
callback would still be called for the data interface and would go about
releasing already freed resources.

Fixes: c93d81955005 ("usb: cdc-acm: fix error handling in acm_probe()")
Cc: stable@vger.kernel.org      # 3.9
Cc: Alexey Khoroshilov <khoroshilov@ispras.ru>
Signed-off-by: Johan Hovold <johan@kernel.org>
---
 drivers/usb/class/cdc-acm.c | 5 +++++
 1 file changed, 5 insertions(+)

Comments

Oliver Neukum March 22, 2021, 9:39 a.m. UTC | #1 
Am Donnerstag, den 18.03.2021, 16:51 +0100 schrieb Johan Hovold:
> If tty-device registration fails the driver would fail to release the

> data interface. When the device is later disconnected, the disconnect

> callback would still be called for the data interface and would go about

> releasing already freed resources.

> 

> Fixes: c93d81955005 ("usb: cdc-acm: fix error handling in acm_probe()")

> Cc: stable@vger.kernel.org      # 3.9

> Cc: Alexey Khoroshilov <khoroshilov@ispras.ru>

> Signed-off-by: Johan Hovold <johan@kernel.org>]

Acked-by: Oliver Neukum <oneukum@suse.com>
diff mbox series

Patch

diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
index d75a78ad464d..dfc2480add91 100644
--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -1503,6 +1503,11 @@  static int acm_probe(struct usb_interface *intf,
 
 	return 0;
 alloc_fail6:
+	if (!acm->combined_interfaces) {
+		/* Clear driver data so that disconnect() returns early. */
+		usb_set_intfdata(data_interface, NULL);
+		usb_driver_release_interface(&acm_driver, data_interface);
+	}
 	if (acm->country_codes) {
 		device_remove_file(&acm->control->dev,
 				&dev_attr_wCountryCodes);