Home Home > GIT Browse > SLE12-SP5-AZURE
summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorOliver Neukum <oneukum@suse.com>2019-08-20 13:00:07 +0200
committerOliver Neukum <oneukum@suse.com>2019-08-20 13:50:51 +0200
commitf73861c56a3f722f666e5f9b98c1911e3d0037ed (patch)
tree51fc9dcf81e437d6dfd491151a19dcfd7aef2c48
parent40c0bfb05119ad3673acd7c40788d5751508d473 (diff)
usb: cdc-acm: make sure a refcount is taken early enough
(bsc#1142635).
-rw-r--r--patches.fixes/0001-usb-cdc-acm-make-sure-a-refcount-is-taken-early-enou.patch56
-rw-r--r--series.conf1
2 files changed, 57 insertions, 0 deletions
diff --git a/patches.fixes/0001-usb-cdc-acm-make-sure-a-refcount-is-taken-early-enou.patch b/patches.fixes/0001-usb-cdc-acm-make-sure-a-refcount-is-taken-early-enou.patch
new file mode 100644
index 0000000000..a57409795f
--- /dev/null
+++ b/patches.fixes/0001-usb-cdc-acm-make-sure-a-refcount-is-taken-early-enou.patch
@@ -0,0 +1,56 @@
+From c52873e5a1ef72f845526d9f6a50704433f9c625 Mon Sep 17 00:00:00 2001
+From: Oliver Neukum <oneukum@suse.com>
+Date: Thu, 8 Aug 2019 16:21:19 +0200
+Subject: [PATCH] usb: cdc-acm: make sure a refcount is taken early enough
+Git-commit: c52873e5a1ef72f845526d9f6a50704433f9c625
+Patch-mainline: v5.3-rc5
+References: bsc#1142635
+
+destroy() will decrement the refcount on the interface, so that
+it needs to be taken so early that it never undercounts.
+
+Fixes: 7fb57a019f94e ("USB: cdc-acm: Fix potential deadlock (lockdep warning)")
+Cc: stable <stable@vger.kernel.org>
+Reported-and-tested-by: syzbot+1b2449b7b5dc240d107a@syzkaller.appspotmail.com
+Signed-off-by: Oliver Neukum <oneukum@suse.com>
+Link: https://lore.kernel.org/r/20190808142119.7998-1-oneukum@suse.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/class/cdc-acm.c | 12 +++++++-----
+ 1 file changed, 7 insertions(+), 5 deletions(-)
+
+--- a/drivers/usb/class/cdc-acm.c
++++ b/drivers/usb/class/cdc-acm.c
+@@ -1342,10 +1342,6 @@ made_compressed_probe:
+ if (acm == NULL)
+ goto alloc_fail;
+
+- minor = acm_alloc_minor(acm);
+- if (minor < 0)
+- goto alloc_fail1;
+-
+ ctrlsize = usb_endpoint_maxp(epctrl);
+ readsize = usb_endpoint_maxp(epread) *
+ (quirks == SINGLE_RX_URB ? 1 : 2);
+@@ -1353,6 +1349,13 @@ made_compressed_probe:
+ acm->writesize = usb_endpoint_maxp(epwrite) * 20;
+ acm->control = control_interface;
+ acm->data = data_interface;
++
++ usb_get_intf(acm->control); /* undone in destruct() */
++
++ minor = acm_alloc_minor(acm);
++ if (minor < 0)
++ goto alloc_fail1;
++
+ acm->minor = minor;
+ acm->dev = usb_dev;
+ if (h.usb_cdc_acm_descriptor)
+@@ -1501,7 +1504,6 @@ skip_countries:
+ usb_driver_claim_interface(&acm_driver, data_interface, acm);
+ usb_set_intfdata(data_interface, acm);
+
+- usb_get_intf(control_interface);
+ tty_dev = tty_port_register_device(&acm->port, acm_tty_driver, minor,
+ &control_interface->dev);
+ if (IS_ERR(tty_dev)) {
diff --git a/series.conf b/series.conf
index 598936e51f..6880f5caa7 100644
--- a/series.conf
+++ b/series.conf
@@ -23407,6 +23407,7 @@
patches.drivers/ALSA-usb-audio-Fix-an-OOB-bug-in-parse_audio_mixer_u.patch
patches.drivers/ALSA-usb-audio-Fix-a-stack-buffer-overflow-bug-in-ch.patch
patches.fixes/nvme-multipath-revalidate-nvme_ns_head-gendisk-in-nv.patch
+ patches.fixes/0001-usb-cdc-acm-make-sure-a-refcount-is-taken-early-enou.patch
# dhowells/linux-fs keys-uefi
patches.suse/0001-KEYS-Allow-unrestricted-boot-time-addition-of-keys-t.patch