• A
    USB: fix invalid memory access in hub_activate() · e50293ef
    Alan Stern 提交于
    Commit 8520f380 ("USB: change hub initialization sleeps to
    delayed_work") changed the hub_activate() routine to make part of it
    run in a workqueue.  However, the commit failed to take a reference to
    the usb_hub structure or to lock the hub interface while doing so.  As
    a result, if a hub is plugged in and quickly unplugged before the work
    routine can run, the routine will try to access memory that has been
    deallocated.  Or, if the hub is unplugged while the routine is
    running, the memory may be deallocated while it is in active use.
    
    This patch fixes the problem by taking a reference to the usb_hub at
    the start of hub_activate() and releasing it at the end (when the work
    is finished), and by locking the hub interface while the work routine
    is running.  It also adds a check at the start of the routine to see
    if the hub has already been disconnected, in which nothing should be
    done.
    Signed-off-by: NAlan Stern <stern@rowland.harvard.edu>
    Reported-by: NAlexandru Cornea <alexandru.cornea@intel.com>
    Tested-by: NAlexandru Cornea <alexandru.cornea@intel.com>
    Fixes: 8520f380 ("USB: change hub initialization sleeps to delayed_work")
    CC: <stable@vger.kernel.org>
    Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>
    e50293ef
hub.c 162.3 KB