No description
  • C 98.2%
  • Assembly 1%
  • Makefile 0.3%
  • Shell 0.2%
  • Python 0.1%
Find a file
Repository files (latest commit first)
Filename Latest commit message Latest commit date
Alan Stern 613045bfc6 HID: usbhid: Fix race between usbhid_close() and usbhid_stop()
commit 0ed08faded1da03eb3def61502b27f81aef2e615 upstream.

The syzbot fuzzer discovered a bad race between in the usbhid driver
between usbhid_stop() and usbhid_close().  In particular,
usbhid_stop() does:

	usb_free_urb(usbhid->urbin);
	...
	usbhid->urbin = NULL; /* don't mess up next start */

and usbhid_close() does:

	usb_kill_urb(usbhid->urbin);

with no mutual exclusion.  If the two routines happen to run
concurrently so that usb_kill_urb() is called in between the
usb_free_urb() and the NULL assignment, it will access the
deallocated urb structure -- a use-after-free bug.

This patch adds a mutex to the usbhid private structure and uses it to
enforce mutual exclusion of the usbhid_start(), usbhid_stop(),
usbhid_open() and usbhid_close() callbacks.

Reported-and-tested-by: syzbot+7bf5a7b0f0a1f9446f4c@syzkaller.appspotmail.com
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
CC: <stable@vger.kernel.org>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-05-14 07:58:24 +02:00
arch x86/kvm: fix a missing-prototypes "vmread_error" 2020-05-10 10:31:31 +02:00
block blk-mq: Put driver tag in blk_mq_dispatch_rq_list() when no budget 2020-05-02 08:48:59 +02:00
certs
crypto crypto: rng - Fix a refcounting bug in crypto_rng_reset() 2020-04-17 10:50:16 +02:00
Documentation USB: hub: Revert commit bd0e6c9614 ("usb: hub: try old enumeration scheme first for high speed devices") 2020-04-29 16:33:14 +02:00
drivers HID: usbhid: Fix race between usbhid_close() and usbhid_stop() 2020-05-14 07:58:24 +02:00
fs cifs: do not share tcons with DFS 2020-05-10 10:31:27 +02:00
include tunnel: Propagate ECT(1) when decapsulating as recommended by RFC6040 2020-05-14 07:58:22 +02:00
init printk: queue wake_up_klogd irq_work only if per-CPU areas are ready 2020-05-02 08:48:42 +02:00
ipc ipc/util.c: sysvipc_find_ipc() should increase position index 2020-04-29 16:33:00 +02:00
kernel tracing/kprobes: Fix a double initialization typo 2020-05-14 07:58:18 +02:00
lib lib: devres: add a helper function for ioremap_uc 2020-05-10 10:31:30 +02:00
LICENSES
mm mm/mremap: Add comment explaining the untagging behaviour of mremap() 2020-05-10 10:31:33 +02:00
net sctp: Fix bundling of SHUTDOWN with COOKIE-ACK 2020-05-14 07:58:24 +02:00
samples vmalloc: fix remap_vmalloc_range() bounds checks 2020-04-29 16:33:14 +02:00
scripts scripts/config: allow colons in option strings for sed 2020-05-10 10:31:27 +02:00
security selinux: properly handle multiple messages in selinux_netlink_send() 2020-05-06 08:15:17 +02:00
sound ALSA: hda: Match both PCI ID and SSID for driver blacklist 2020-05-10 10:31:31 +02:00
tools tools headers UAPI: Sync copy of arm64's asm/unistd.h with the kernel sources 2020-05-10 10:31:33 +02:00
usr initramfs: restore default compression behavior 2020-04-08 09:08:38 +02:00
virt
.clang-format
.cocciconfig
.get_maintainer.ignore
.gitattributes
.gitignore
.mailmap
COPYING
CREDITS
Kbuild
Kconfig
MAINTAINERS
Makefile Linux 5.4.40 2020-05-10 10:31:34 +02:00
README

Linux kernel
============

There are several guides for kernel developers and users. These guides can
be rendered in a number of formats, like HTML and PDF. Please read
Documentation/admin-guide/README.rst first.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.  The formatted documentation can also be read online at:

    https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory,
several of them using the Restructured Text markup notation.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.