]> git.kernelconcepts.de Git - karo-tx-linux.git/commit
USB: cdc-acm: Fix disconnect() vs close() race
authorHavard Skinnemoen <hskinnemoen@google.com>
Wed, 9 Nov 2011 21:47:38 +0000 (13:47 -0800)
committerGreg Kroah-Hartman <gregkh@suse.de>
Sat, 26 Nov 2011 17:10:02 +0000 (09:10 -0800)
commitbbf54d177037d268d9a744ee4c2add570ba8a9ad
treeb52a25b7a330983c8a555de7f4a2c963df94e370
parent0841db56cfb4cd090cbdd52dc2c7f39a70042e15
USB: cdc-acm: Fix disconnect() vs close() race

commit 5dc2470c602da8851907ec18942cd876c3b4ecc1 upstream.

There's a race between the USB disconnect handler and the TTY close
handler which may cause the acm object to be freed while it's still
being used. This may lead to things like

http://article.gmane.org/gmane.linux.usb.general/54250

and

https://lkml.org/lkml/2011/5/29/64

This is the simplest fix I could come up with. Holding on to open_mutex
while closing the TTY device prevents acm_disconnect() from freeing the
acm object between acm->port.count drops to 0 and the TTY side of the
cleanups are finalized.

Signed-off-by: Havard Skinnemoen <hskinnemoen@google.com>
Cc: Oliver Neukum <oliver@neukum.name>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
drivers/usb/class/cdc-acm.c