linux-kernel - Re: [PATCH] USB: usb-skeleton.c: fix compilation error and restore kref_put on fail in skel

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:	Wed, 10 Oct 2012 11:55:45 +0200
From:	Oliver Neukum <oneukum@...e.de>
To:	Constantine Shulyupin <const@...elinux.com>
Cc:	gregkh@...uxfoundation.org, linux-usb@...r.kernel.org,
	linux-kernel@...r.kernel.org
Subject: Re: [PATCH] USB: usb-skeleton.c: fix compilation error and restore kref_put on fail in skel_open

On Sunday 07 October 2012 11:57:12 Constantine Shulyupin wrote:
> From: Constantine Shulyupin <const@...eLinux.com>
> 
> Function skel_open increments usage count for the device with kref_get and the usage count should be decremented on the function failure.
> 
> Some last changes in function skel_open and finally commit
> 52a7499 Revert "USB: usb-skeleton.c: fix open/disconnect race"
> introduced a bug in function skel_open, which this patch fixes.
> 
> Signed-off-by: Constantine Shulyupin <const@...eLinux.com>
> ---
>  drivers/usb/usb-skeleton.c |    6 ++++--
>  1 file changed, 4 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/usb/usb-skeleton.c b/drivers/usb/usb-skeleton.c
> index 0616f23..027005b 100644
> --- a/drivers/usb/usb-skeleton.c
> +++ b/drivers/usb/usb-skeleton.c
> @@ -113,8 +113,10 @@ static int skel_open(struct inode *inode, struct file *file)
>  	mutex_lock(&dev->io_mutex);
>  
>  	retval = usb_autopm_get_interface(interface);
> -	if (retval)
> -		goto out_err;
> +	if (retval) {
> +		kref_put(&dev->kref, skel_delete);
> +		goto exit;
> +	}
>  
>  	/* save our object in the file's private structure */
>  	file->private_data = dev;

Hi,

good catch, but the fix is wrong. You also need to drop the lock.

	Regards
		Oliver


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/