USB: serial: fix port tear down use-after-free
Get series with b4
b4 am [email protected]Versions newest first · linked by author and title
- v2 Latest4 patches 0 repliesNew
- v12 patches 3 repliesSuperseded
Changes in v2 from the cover letter
- fix dynamic id driver deregistration race (new)
- remove "new_id" attributes before deregistering USB driver
- use iterator for driver deregistration (new)
Patches in v2 No applies recorded yet
| # | Subject and files | Size | Replies | Applied |
|---|---|---|---|---|
| 1/4 | USB: serial: fix port tear down use-after-freedrivers/ | +7 | 0 replies | |
| 2/4 | USB: serial: fix dynamic id driver deregistration racedrivers/ | +1 | 0 replies | |
| 3/4 | USB: serial: fix driver deregistration orderdrivers/ drivers/ include/ | +23 | 0 replies | |
| 4/4 | USB: serial: use iterator for driver deregistrationdrivers/ | +2 | 0 replies |
Reviews trailers per patch
1 of 4 patches has a Reviewed-by or Acked-by.
| Patch | Greg Kroah-Hartman |
|---|---|
| 1/4 | R-b |
| 2/4 | |
| 3/4 | |
| 4/4 |
Trailers given in replies are filled; those carried in the patches from earlier versions are outlined with dashes.
Cover letter [PATCH v2 0/4] USB: serial: fix port tear down use-after-free
When addressing a port probe ordering issue in digi_acceleport recently I realised that we have a corresponding general problem during disconnect, but I didn't have time to address it straight away.
Now syzbot has managed to trigger one of its symptoms and people have already started submitting incomplete band-aids so here is a proper fix.
When testing the fix I also noticed that we have an ordering issue when deregistering drivers that can result in similar use-after-free.
Johan
Changes in v2:
- fix dynamic id driver deregistration race (new)
- remove "new_id" attributes before deregistering USB driver
- use iterator for driver deregistration (new)
Johan Hovold (4):
USB: serial: fix port tear down use-after-free
USB: serial: fix dynamic id driver deregistration race
USB: serial: fix driver deregistration order
USB: serial: use iterator for driver deregistration
drivers/usb/serial/bus.c | 6 +++++- drivers/usb/serial/usb-serial.c | 32 ++++++++++++++++++++++++++------ include/linux/usb/serial.h | 1 + 3 files changed, 32 insertions(+), 7 deletions(-)
Signature · 1 line
2.54.0