diff options
author | Valentine Barshak <vbarshak@mvista.com> | 2010-12-06 17:51:41 +0300 |
---|---|---|
committer | Jiri Kosina <jkosina@suse.cz> | 2010-12-07 15:45:49 +0100 |
commit | 1a8e8fab790ea7af81b8f964fdec706ad1ec2271 (patch) | |
tree | 21dcfd0e58d2d4369481b8d7dfa2d13e0263c40a /drivers/block | |
parent | ce06b9d6d33fd2ed799b6e825d68fe95077da354 (diff) | |
download | linux-3.10-1a8e8fab790ea7af81b8f964fdec706ad1ec2271.tar.gz linux-3.10-1a8e8fab790ea7af81b8f964fdec706ad1ec2271.tar.bz2 linux-3.10-1a8e8fab790ea7af81b8f964fdec706ad1ec2271.zip |
HID: Fix race between disconnect and hiddev_ioctl
A USB HID device can be disconnected at any time.
If this happens right before or while hiddev_ioctl is in progress,
the hiddev_ioctl tries to access invalid hiddev->hid pointer.
When the hid device is disconnected, the hiddev_disconnect()
ends up with a call to hid_device_release() which frees
hid_device, but doesn't set the hiddev->hid pointer to NULL.
If the deallocated memory region has been re-used by the kernel,
this can cause a crash or memory corruption.
Since disconnect can happen at any time, we can't initialize
struct hid_device *hid = hiddev->hid at the beginning of ioctl
and then use it.
This change checks hiddev->exist flag while holding
the existancelock and uses hid_device only if it exists.
Signed-off-by: Valentine Barshak <vbarshak@mvista.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Diffstat (limited to 'drivers/block')
0 files changed, 0 insertions, 0 deletions