]> git.baikalelectronics.ru Git - kernel.git/commit
USB: cdc-acm: Fix disconnect() vs close() race
authorHavard Skinnemoen <hskinnemoen@google.com>
Wed, 9 Nov 2011 21:47:38 +0000 (13:47 -0800)
committerGreg Kroah-Hartman <gregkh@suse.de>
Mon, 14 Nov 2011 21:47:49 +0000 (13:47 -0800)
commitac305fdf25e6200a85f9770bf7484bf0f80ed312
treea6ef0bac36a5d207ebb9cdfe3e5285bba0d53e40
parent2c604a88170580e67f6b7aa23a503c6cdb49d8df
USB: cdc-acm: Fix disconnect() vs close() race

There's a race between the USB disconnect handler and the TTY close
handler which may cause the acm object to be freed while it's still
being used. This may lead to things like

http://article.gmane.org/gmane.linux.usb.general/54250

and

https://lkml.org/lkml/2011/5/29/64

This is the simplest fix I could come up with. Holding on to open_mutex
while closing the TTY device prevents acm_disconnect() from freeing the
acm object between acm->port.count drops to 0 and the TTY side of the
cleanups are finalized.

Signed-off-by: Havard Skinnemoen <hskinnemoen@google.com>
Cc: Oliver Neukum <oliver@neukum.name>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
drivers/usb/class/cdc-acm.c