• Russ Dill's avatar
    USB: Close usb_find_interface race · a2582bd4
    Russ Dill authored
    USB drivers that create character devices call usb_register_dev in their
    probe function. This associates the usb_interface device with that minor
    number and creates the character device and announces it to the world.
    However, the driver's probe function is called before the new
    usb_interface is added to the driver's klist_devices.
    
    This is a problem because userspace will respond to the character device
    creation announcement by opening the character device. The driver's open
    function will the call usb_find_interface to find the usb_interface
    associated with that minor number. usb_find_interface will walk the
    driver's list of devices and find the usb_interface with the matching
    minor number.
    
    Because the announcement happens before the usb_interface is added to the
    driver's klist_devices, a race condition exists. A straightforward fix
    is to walk the list of devices on usb_bus_type instead since the device
    is added to that list before the announcement occurs.
    
    bus_find_device calls get_device to bump the reference count on the found
    device. It is arguable that the reference count should be dropped by the
    caller of usb_find_interface instead of usb_find_interface, however,
    the current users of usb_find_interface do not expect this.
    Signed-off-by: default avatarRuss Dill <Russ.Dill@gmail.com>
    Cc: stable <stable@kernel.org>
    Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@suse.de>
    a2582bd4
usb.c 31.9 KB