From patchwork Mon Dec 28 12:49:56 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 354245 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-18.7 required=3.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_CR_TRAILER, INCLUDES_PATCH,MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,URIBL_RED, USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 15D35C43331 for ; Mon, 28 Dec 2020 16:44:46 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id D9D92229EF for ; Mon, 28 Dec 2020 16:44:45 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1729391AbgL1Qob (ORCPT ); Mon, 28 Dec 2020 11:44:31 -0500 Received: from mail.kernel.org ([198.145.29.99]:53240 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1728323AbgL1M5Y (ORCPT ); Mon, 28 Dec 2020 07:57:24 -0500 Received: by mail.kernel.org (Postfix) with ESMTPSA id E377D208D5; Mon, 28 Dec 2020 12:57:08 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1609160229; bh=KOoJc5JTb36RPmNjEg6gF6NNmOD4K3nWpA6dERLmLYw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=0/o/gk9IDTs1O+gQSbDLt/Pz5tDj2KfG2dXebwXpwtbEplH6MaIqw/kLyPleghLfE 2oqBODcE23fDoqnUSJXe1IpexD3ddbMrkOpgUjw+uCaVE+dPsxa1/bMfnGxmmQVoTI sLFLTqdjCU8O7XnbuCM2pm7+i6BsH7EX0+vW4kRc= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Sebastian Andrzej Siewior , Johan Hovold Subject: [PATCH 4.4 112/132] USB: serial: keyspan_pda: fix write-wakeup use-after-free Date: Mon, 28 Dec 2020 13:49:56 +0100 Message-Id: <20201228124851.827005376@linuxfoundation.org> X-Mailer: git-send-email 2.29.2 In-Reply-To: <20201228124846.409999325@linuxfoundation.org> References: <20201228124846.409999325@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Johan Hovold commit 37faf50615412947868c49aee62f68233307f4e4 upstream. The driver's deferred write wakeup was never flushed on disconnect, something which could lead to the driver port data being freed while the wakeup work is still scheduled. Fix this by using the usb-serial write wakeup which gets cancelled properly on disconnect. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable@vger.kernel.org Acked-by: Sebastian Andrzej Siewior Reviewed-by: Greg Kroah-Hartman Signed-off-by: Johan Hovold Signed-off-by: Greg Kroah-Hartman --- drivers/usb/serial/keyspan_pda.c | 17 +++-------------- 1 file changed, 3 insertions(+), 14 deletions(-) --- a/drivers/usb/serial/keyspan_pda.c +++ b/drivers/usb/serial/keyspan_pda.c @@ -47,8 +47,7 @@ struct keyspan_pda_private { int tx_room; int tx_throttled; - struct work_struct wakeup_work; - struct work_struct unthrottle_work; + struct work_struct unthrottle_work; struct usb_serial *serial; struct usb_serial_port *port; }; @@ -101,15 +100,6 @@ static const struct usb_device_id id_tab }; #endif -static void keyspan_pda_wakeup_write(struct work_struct *work) -{ - struct keyspan_pda_private *priv = - container_of(work, struct keyspan_pda_private, wakeup_work); - struct usb_serial_port *port = priv->port; - - tty_port_tty_wakeup(&port->port); -} - static void keyspan_pda_request_unthrottle(struct work_struct *work) { struct keyspan_pda_private *priv = @@ -187,7 +177,7 @@ static void keyspan_pda_rx_interrupt(str case 2: /* tx unthrottle interrupt */ priv->tx_throttled = 0; /* queue up a wakeup at scheduler time */ - schedule_work(&priv->wakeup_work); + usb_serial_port_softint(port); break; default: break; @@ -567,7 +557,7 @@ static void keyspan_pda_write_bulk_callb priv = usb_get_serial_port_data(port); /* queue up a wakeup at scheduler time */ - schedule_work(&priv->wakeup_work); + usb_serial_port_softint(port); } @@ -733,7 +723,6 @@ static int keyspan_pda_port_probe(struct if (!priv) return -ENOMEM; - INIT_WORK(&priv->wakeup_work, keyspan_pda_wakeup_write); INIT_WORK(&priv->unthrottle_work, keyspan_pda_request_unthrottle); priv->serial = port->serial; priv->port = port;