]> www.infradead.org Git - users/jedix/linux-maple.git/commit
USB: serial: mxuport: fix use-after-free in probe error path
authorJohan Hovold <johan@kernel.org>
Sun, 8 May 2016 18:08:01 +0000 (20:08 +0200)
committerDhaval Giani <dhaval.giani@oracle.com>
Fri, 20 Jan 2017 22:21:54 +0000 (17:21 -0500)
commitcc0af6606e7721ab29c2cd0d13a1c937a20df8ca
treebc389df3520108d25ee16b24e681bc3f9b1397fd
parentaa0b662a86f5f9710f67282c0b989a8423fc95bd
USB: serial: mxuport: fix use-after-free in probe error path

Orabug: 25256930

[ Upstream commit 9e45284984096314994777f27e1446dfbfd2f0d7 ]

The interface read and event URBs are submitted in attach, but were
never explicitly unlinked by the driver. Instead the URBs would have
been killed by usb-serial core on disconnect.

In case of a late probe error (e.g. due to failed minor allocation),
disconnect is never called and we could end up with active URBs for an
unbound interface. This in turn could lead to deallocated memory being
dereferenced in the completion callbacks.

Fixes: ee467a1f2066 ("USB: serial: add Moxa UPORT 12XX/14XX/16XX
driver")
Cc: stable <stable@vger.kernel.org> # v3.14
Signed-off-by: Johan Hovold <johan@kernel.org>
Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
(cherry picked from commit 17e958ca3f508c361325688ab1da7144febb35fe)
Signed-off-by: Dhaval Giani <dhaval.giani@oracle.com>
drivers/usb/serial/mxuport.c