USB: xhci: dbc: fix tty registration race
Subsystems (3)
PATCH 1/1 USB: xhci: dbc: fix tty registration race
Make sure to allocate resources before registering the tty device to avoid having a racing open() and write() fail to enable rx or dereference a NULL pointer when accessing the uninitialised fifo.
Fixes dfba2174dc42 ("usb: xhci: Add DbC support in xHCI driver")
Cc [email protected] # 4.16
Cc Lu Baolu <[email protected]>
Signed-off-by Johan Hovold <[email protected]>
--- drivers/usb/host/xhci-dbgtty.c | 28 +++++++++++++--------------- 1 file changed, 13 insertions(+), 15 deletions(-)
drivers/usb/host/xhci-dbgtty.c +13 -15
@@ -408,40 +408,38 @@ static int xhci_dbc_tty_register_device(struct xhci_dbc *dbc)return -EBUSY ;xhci_dbc_tty_init_port (dbc, port); - tty_dev =tty_port_register_device (&port->port, - dbc_tty_driver,0 ,NULL ); -if (IS_ERR (tty_dev)) { - ret =PTR_ERR (tty_dev); - goto register_fail; - } ret =kfifo_alloc (&port->write_fifo,DBC_WRITE_BUF_SIZE ,GFP_KERNEL );if (ret) - goto buf_alloc_fail; + goto err_exit_port; ret =xhci_dbc_alloc_requests (dbc,BULK_IN , &port->read_pool, dbc_read_complete);if (ret) - goto request_fail; + goto err_free_fifo; ret =xhci_dbc_alloc_requests (dbc,BULK_OUT , &port->write_pool, dbc_write_complete);if (ret) - goto request_fail; + goto err_free_requests; + + tty_dev =tty_port_register_device (&port->port, + dbc_tty_driver,0 ,NULL ); +if (IS_ERR (tty_dev)) { + ret =PTR_ERR (tty_dev); + goto err_free_requests; + } port->registered = true;return 0 ; -request_fail: +err_free_requests:xhci_dbc_free_requests (&port->read_pool);xhci_dbc_free_requests (&port->write_pool); +err_free_fifo:kfifo_free (&port->write_fifo); - -buf_alloc_fail: -tty_unregister_device (dbc_tty_driver,0 ); - -register_fail: +err_exit_port:xhci_dbc_tty_exit_port (port);dev_err (dbc->dev,"can't register tty port, err %d\n" , ret);
Signature · 1 line
2.32.0
Quoted 8 lines · Johan Hovold
Make sure to allocate resources before registering the tty device to avoid having a racing
open()andwrite()fail to enable rx or dereference a NULL pointer when accessing the uninitialised fifo.Fixes dfba2174dc42 ("usb: xhci: Add DbC support in xHCI driver")Cc [email protected] # 4.16Cc Lu Baolu <[email protected]>Signed-off-by Johan Hovold <[email protected]>
Thanks, adding to queue
-Mathias