github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-07-27 09:36:22 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

usb: core: sysfs: add lock to bos_descriptors_read()

Browse Source 
Add a lock to the function bos_descriptors_read().

This function accesses udev->bos, which could be simultaneously freed in
usb_reset_and_verify_device(), a function that is commonly called in
drivers all over the kernel.

Assisted-by: gkh_clanker_t1000
Signed-off-by: Griffin Kroah-Hartman <griffin@kroah.com>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Cc: stable <stable@kernel.org>
Link: https://patch.msgid.link/20260715-usb_core_patches_3-v1-1-53021f5576fd@kroah.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Griffin Kroah-Hartman 2026-07-15 16:59:05 +02:00 committed by Greg Kroah-Hartman
parent c947360ae6
commit 4e0197fbb0
1 changed files with 7 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
drivers/usb/core/sysfs.c
View File

@ -899,10 +899,15 @@ bos_descriptors_read(struct file *filp, struct kobject *kobj,
{
struct device *dev = kobj_to_dev(kobj);
struct usb_device *udev = to_usb_device(dev);
struct usb_host_bos *bos = udev->bos;
struct usb_host_bos *bos;
struct usb_bos_descriptor *desc;
size_t desclen, n = 0;
int rc;
rc = usb_lock_device_interruptible(udev);
if (rc < 0)
return -EINTR;
bos = udev->bos;
if (bos) {
desc = bos->desc;
desclen = le16_to_cpu(desc->wTotalLength);
@ -911,6 +916,7 @@ bos_descriptors_read(struct file *filp, struct kobject *kobj,
memcpy(buf, (void *) desc + off, n);
}
}
usb_unlock_device(udev);
return n;
}
static const BIN_ATTR_RO(bos_descriptors, 65535); /* max-size BOS */