adulau/aha
1
0
Fork 0
mirror of https://github.com/adulau/aha.git synced 2024-12-29 12:16:20 +00:00
Code Issues Projects Releases Packages Wiki Activity

USB: Close usb_find_interface race

Browse source 
USB drivers that create character devices call usb_register_dev in their
probe function. This associates the usb_interface device with that minor
number and creates the character device and announces it to the world.
However, the driver's probe function is called before the new
usb_interface is added to the driver's klist_devices.

This is a problem because userspace will respond to the character device
creation announcement by opening the character device. The driver's open
function will the call usb_find_interface to find the usb_interface
associated with that minor number. usb_find_interface will walk the
driver's list of devices and find the usb_interface with the matching
minor number.

Because the announcement happens before the usb_interface is added to the
driver's klist_devices, a race condition exists. A straightforward fix
is to walk the list of devices on usb_bus_type instead since the device
is added to that list before the announcement occurs.

bus_find_device calls get_device to bump the reference count on the found
device. It is arguable that the reference count should be dropped by the
caller of usb_find_interface instead of usb_find_interface, however,
the current users of usb_find_interface do not expect this.

Signed-off-by: Russ Dill <Russ.Dill@gmail.com>
Cc: stable <stable@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
This commit is contained in:
Russ Dill 2009-11-18 11:02:13 -07:00 committed by Greg Kroah-Hartman
parent 22a627ba81
commit a2582bd478
1 changed files with 10 additions and 18 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

28
drivers/usb/core/usb.c
View file

@ -130,24 +130,17 @@ struct usb_host_interface *usb_altnum_to_altsetting(
} }
EXPORT_SYMBOL_GPL(usb_altnum_to_altsetting); EXPORT_SYMBOL_GPL(usb_altnum_to_altsetting);
struct find_interface_arg {
int minor;
struct usb_interface *interface;
};
static int __find_interface(struct device *dev, void *data) static int __find_interface(struct device *dev, void *data)
{ {
struct find_interface_arg *arg = data; int *minor = data;
struct usb_interface *intf; struct usb_interface *intf;
if (!is_usb_interface(dev)) if (!is_usb_interface(dev))
return 0; return 0;
intf = to_usb_interface(dev); intf = to_usb_interface(dev);
if (intf->minor != -1 && intf->minor == arg->minor) { if (intf->minor != -1 && intf->minor == *minor)
arg->interface = intf;
return 1; return 1;
}
return 0; return 0;
} }
@ -156,21 +149,20 @@ static int __find_interface(struct device *dev, void *data)
* @drv: the driver whose current configuration is considered * @drv: the driver whose current configuration is considered
* @minor: the minor number of the desired device * @minor: the minor number of the desired device
* *
* This walks the driver device list and returns a pointer to the interface * This walks the bus device list and returns a pointer to the interface
* with the matching minor. Note, this only works for devices that share the * with the matching minor. Note, this only works for devices that share the
* USB major number. * USB major number.
*/ */
struct usb_interface *usb_find_interface(struct usb_driver *drv, int minor) struct usb_interface *usb_find_interface(struct usb_driver *drv, int minor)
{ {
struct find_interface_arg argb; struct device *dev;
int retval;
argb.minor = minor; dev = bus_find_device(&usb_bus_type, NULL, &minor, __find_interface);
argb.interface = NULL;
/* eat the error, it will be in argb.interface */ /* Drop reference count from bus_find_device */
retval = driver_for_each_device(&drv->drvwrap.driver, NULL, &argb, put_device(dev);
__find_interface);
return argb.interface; return dev ? to_usb_interface(dev) : NULL;
} }
EXPORT_SYMBOL_GPL(usb_find_interface); EXPORT_SYMBOL_GPL(usb_find_interface);