linux-kernel - [PATCH] p54usb: fix usb_kill_urb hang with slub

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <200812051547.45790.chunkeey@web.de>
Date:	Fri, 5 Dec 2008 15:47:45 +0100
From:	Christian Lamparter <chunkeey@....de>
To:	linux-wireless@...r.kernel.org
Cc:	Johannes Berg <johannes@...solutions.net>,
	John W Linville <linville@...driver.com>,
	linux-usb@...r.kernel.org, gregkh@...e.de,
	linux-kernel@...r.kernel.org
Subject: [PATCH] p54usb: fix usb_kill_urb hang with slub_debug=P

This patch fixes a problem identified by Johannes Berg.

It looks like this is a classic case of "use-after-freed". 
A module which should reproduce the problem on
any other USB device can be found right here:
http://kerneltrap.org/mailarchive/linux-usb/2008/12/4/4317064

Tested-by: Johannes Berg <johannes@...solutions.net>
Signed-off-by: Christian Lamparter <chunkeey@....de>
CC: stable@...r.kernel.org
---
diff --git a/drivers/net/wireless/p54/p54usb.c b/drivers/net/wireless/p54/p54usb.c
index 3444f52..0b9a922 100644
--- a/drivers/net/wireless/p54/p54usb.c
+++ b/drivers/net/wireless/p54/p54usb.c
@@ -209,7 +209,14 @@ static void p54u_free_urbs(struct ieee80211_hw *dev)
 		if (!info->urb)
 			continue;
 
+		/*
+		 * usb_get_urb and usb_free_urb are part of a temporary
+		 * workaround. Otherwise we get a pretty bad freeze,
+		 * if SLUB's poisoning debug option is enabled.
+		 */
+		usb_get_urb(info->urb);
 		usb_kill_urb(info->urb);
+		usb_free_urb(info->urb);
 		kfree_skb(skb);
 	}
 }

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/