Commit c057908f authored by Duncan Sands's avatar Duncan Sands Committed by Greg Kroah-Hartman

[PATCH] USB usbfs: missing lock in proc_getdriver

Hi Oliver,

> I expect it to rarely matter, but it might matter now and then. It's
> just a question of hygiene. If you are using a temporary buffer I'd
> like to see it used to full advantage. So either drop the lock or do
> a direct copy. I'd prefer the first option your patch implemented.

I agree.  Greg, please consider applying the updated patch:



Protect against driver binding changes while reading the driver name.
parent d4b73114
...@@ -708,13 +708,15 @@ static int proc_getdriver(struct dev_state *ps, void __user *arg) ...@@ -708,13 +708,15 @@ static int proc_getdriver(struct dev_state *ps, void __user *arg)
return -EFAULT; return -EFAULT;
if ((ret = findintfif(ps->dev, gd.interface)) < 0) if ((ret = findintfif(ps->dev, gd.interface)) < 0)
return ret; return ret;
down_read(&usb_bus_type.subsys.rwsem);
interface = ps->dev->actconfig->interface[ret]; interface = ps->dev->actconfig->interface[ret];
if (!interface->dev.driver) if (!interface || !interface->dev.driver) {
up_read(&usb_bus_type.subsys.rwsem);
return -ENODATA; return -ENODATA;
}
strncpy(gd.driver, interface->dev.driver->name, sizeof(gd.driver)); strncpy(gd.driver, interface->dev.driver->name, sizeof(gd.driver));
if (copy_to_user(arg, &gd, sizeof(gd))) up_read(&usb_bus_type.subsys.rwsem);
return -EFAULT; return copy_to_user(arg, &gd, sizeof(gd)) ? -EFAULT : 0;
return 0;
} }
static int proc_connectinfo(struct dev_state *ps, void __user *arg) static int proc_connectinfo(struct dev_state *ps, void __user *arg)
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment