linux-kernel - Re: [patch 25/28] USB: cdc-acm: fix sysfs attribute registration bug

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <Pine.LNX.4.44L0.0708240956570.3862-100000@iolanthe.rowland.org>
Date:	Fri, 24 Aug 2007 09:59:49 -0400 (EDT)
From:	Alan Stern <stern@...land.harvard.edu>
To:	Greg KH <gregkh@...e.de>
cc:	Kernel development list <linux-kernel@...r.kernel.org>,
	<stable@...nel.org>,
	USB development list <linux-usb-devel@...ts.sourceforge.net>,
	Justin Forbes <jmforbes@...uxtx.org>,
	Zwane Mwaikambo <zwane@....linux.org.uk>,
	Theodore Ts'o <tytso@....edu>,
	Randy Dunlap <rdunlap@...otime.net>,
	Dave Jones <davej@...hat.com>,
	Chuck Wolber <chuckw@...ntumlinux.com>,
	Chris Wedgwood <reviews@...cw.f00f.org>,
	Michael Krufky <mkrufky@...uxtv.org>,
	Chuck Ebbert <cebbert@...hat.com>,
	Domenico Andreoli <cavokz@...il.com>,
	<torvalds@...ux-foundation.org>,
	Andrew Morton <akpm@...ux-foundation.org>,
	<alan@...rguk.ukuu.org.uk>, Oliver Neukum <oneukum@...e.de>
Subject: Re: [patch 25/28] USB: cdc-acm: fix sysfs attribute registration
 bug

On Thu, 23 Aug 2007, Greg KH wrote:

> -stable review patch.  If anyone has any objections, please let us know.
> 
> ------------------
> 
> From: Alan Stern <stern@...land.harvard.edu>
> 
> This patch (as950) fixes a bug in the cdc-acm driver.  It doesn't keep
> track of which interface (control or data) the sysfs attributes get
> registered for, and as a result, during disconnect it will sometimes
> attempt to remove the attributes from the wrong interface.  The
> left-over attributes can cause a crash later on, particularly if the driver
> module has been unloaded.
> 
> Signed-off-by: Alan Stern <stern@...land.harvard.edu>
> Acked-by: Oliver Neukum <oneukum@...e.de>
> Signed-off-by: Greg Kroah-Hartman <gregkh@...e.de>
> 
> ---
>  drivers/usb/class/cdc-acm.c |    4 ++++
>  1 file changed, 4 insertions(+)
> 
> --- a/drivers/usb/class/cdc-acm.c
> +++ b/drivers/usb/class/cdc-acm.c
> @@ -900,6 +900,10 @@ next_desc:
>  			return -ENODEV;
>  		}
>  	}
> +
> +	/* Accept probe requests only for the control interface */
> +	if (intf != control_interface)
> +		return -ENODEV;
>  	
>  	if (data_interface_num != call_interface_num)
>  		dev_dbg(&intf->dev,"Seperate call control interface. That is not fully supported.");
> 

Odd.  This doesn't include the entire patch; the second hunk is
missing.  It should go on to say:

@@ -1109,10 +1113,12 @@ static void acm_disconnect(struct usb_interface *intf)
 		return;
 	}
 	if (acm->country_codes){
-		device_remove_file(&intf->dev, &dev_attr_wCountryCodes);
-		device_remove_file(&intf->dev, &dev_attr_iCountryCodeRelDate);
+		device_remove_file(&acm->control->dev,
+				&dev_attr_wCountryCodes);
+		device_remove_file(&acm->control->dev,
+				&dev_attr_iCountryCodeRelDate);
 	}
-	device_remove_file(&intf->dev, &dev_attr_bmCapabilities);
+	device_remove_file(&acm->control->dev, &dev_attr_bmCapabilities);
 	acm->dev = NULL;
 	usb_set_intfdata(acm->control, NULL);
 	usb_set_intfdata(acm->data, NULL);

Alan Stern

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/