]> git.baikalelectronics.ru Git - kernel.git/commit
USB: serial: mxuport: fix use-after-free in probe error path
authorJohan Hovold <johan@kernel.org>
Sun, 8 May 2016 18:08:01 +0000 (20:08 +0200)
committerJohan Hovold <johan@kernel.org>
Tue, 10 May 2016 07:40:03 +0000 (09:40 +0200)
commitaa4707501777de307e0a92ad7f05d573b47e7349
tree1fcb0f9da5435a7198bc906ee83e757546c06ed3
parent2a139bf34f1e997d2ca681e2a2174b93366cdcb7
USB: serial: mxuport: fix use-after-free in probe error path

The interface read and event URBs are submitted in attach, but were
never explicitly unlinked by the driver. Instead the URBs would have
been killed by usb-serial core on disconnect.

In case of a late probe error (e.g. due to failed minor allocation),
disconnect is never called and we could end up with active URBs for an
unbound interface. This in turn could lead to deallocated memory being
dereferenced in the completion callbacks.

Fixes: 966b6675e702 ("USB: serial: add Moxa UPORT 12XX/14XX/16XX
driver")
Cc: stable <stable@vger.kernel.org> # v3.14
Signed-off-by: Johan Hovold <johan@kernel.org>
Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/usb/serial/mxuport.c