From patchwork Mon Apr 5 08:54:22 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg Kroah-Hartman X-Patchwork-Id: 415787 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-18.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_CR_TRAILER, INCLUDES_PATCH, MAILING_LIST_MULTI, SPF_HELO_NONE, SPF_PASS, URIBL_BLOCKED, USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id EE326C43600 for ; Mon, 5 Apr 2021 09:02:13 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id BEA9D613A5 for ; Mon, 5 Apr 2021 09:02:13 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S237421AbhDEJCR (ORCPT ); Mon, 5 Apr 2021 05:02:17 -0400 Received: from mail.kernel.org ([198.145.29.99]:44030 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S237386AbhDEJCN (ORCPT ); Mon, 5 Apr 2021 05:02:13 -0400 Received: by mail.kernel.org (Postfix) with ESMTPSA id 5C694610E8; Mon, 5 Apr 2021 09:02:04 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1617613324; bh=FJo5Vmmz25GM4YFtEhcqfro2GD9UAwMARDZjzhRS9lU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=XY8AJEZUjNIzMZJ9nAkKR7Oxm01Z0HFmO6BpVhFwnGvyJkhO7oviOqf+o1+x0r3mV 48ALmaRozirVF5M5eDMDQo2FBpls0M0W/CYXwjshYhlYWdTaIQjd920MTLBLDCDVY3 Rie3HFbxdfBat5w1lcBXB0OGNknwFDYe2uRMHcp0= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Alexey Khoroshilov , Oliver Neukum , Johan Hovold Subject: [PATCH 4.19 51/56] USB: cdc-acm: fix use-after-free after probe failure Date: Mon, 5 Apr 2021 10:54:22 +0200 Message-Id: <20210405085024.149337382@linuxfoundation.org> X-Mailer: git-send-email 2.31.1 In-Reply-To: <20210405085022.562176619@linuxfoundation.org> References: <20210405085022.562176619@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Johan Hovold commit 4e49bf376c0451ad2eae2592e093659cde12be9a upstream. If tty-device registration fails the driver would fail to release the data interface. When the device is later disconnected, the disconnect callback would still be called for the data interface and would go about releasing already freed resources. Fixes: c93d81955005 ("usb: cdc-acm: fix error handling in acm_probe()") Cc: stable@vger.kernel.org # 3.9 Cc: Alexey Khoroshilov Acked-by: Oliver Neukum Signed-off-by: Johan Hovold Link: https://lore.kernel.org/r/20210322155318.9837-3-johan@kernel.org Signed-off-by: Greg Kroah-Hartman --- drivers/usb/class/cdc-acm.c | 5 +++++ 1 file changed, 5 insertions(+) --- a/drivers/usb/class/cdc-acm.c +++ b/drivers/usb/class/cdc-acm.c @@ -1561,6 +1561,11 @@ skip_countries: return 0; alloc_fail6: + if (!acm->combined_interfaces) { + /* Clear driver data so that disconnect() returns early. */ + usb_set_intfdata(data_interface, NULL); + usb_driver_release_interface(&acm_driver, data_interface); + } if (acm->country_codes) { device_remove_file(&acm->control->dev, &dev_attr_wCountryCodes);