aboutsummaryrefslogtreecommitdiff
path: root/Kbuild
diff options
context:
space:
mode:
authorRuss Dill2009-12-14 21:45:35 -0700
committerGreg Kroah-Hartman2009-12-15 07:50:28 -0800
commitc2d284ee04ab6f6718de2ddcf1b43160e046c41d (patch)
tree915ff77064dd9c6c002f416d2b1ead97d1c7c970 /Kbuild
parentab7cd8c76cb47f1bda0ad964d309b4efce81b5e9 (diff)
USB: Close usb_find_interface race v3
USB drivers that create character devices call usb_register_dev in their probe function. This associates the usb_interface device with that minor number and creates the character device and announces it to the world. However, the driver's probe function is called before the new usb_interface is added to the driver's klist_devices. This is a problem because userspace will respond to the character device creation announcement by opening the character device. The driver's open function will the call usb_find_interface to find the usb_interface associated with that minor number. usb_find_interface will walk the driver's list of devices and find the usb_interface with the matching minor number. Because the announcement happens before the usb_interface is added to the driver's klist_devices, a race condition exists. A straightforward fix is to walk the list of devices on usb_bus_type instead since the device is added to that list before the announcement occurs. bus_find_device calls get_device to bump the reference count on the found device. It is arguable that the reference count should be dropped by the caller of usb_find_interface instead of usb_find_interface, however, the current users of usb_find_interface do not expect this. The original version of this patch only matched against minor number instead of driver and minor number. This version matches against both. Signed-off-by: Russ Dill <Russ.Dill@gmail.com> Cc: stable <stable@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Diffstat (limited to 'Kbuild')
0 files changed, 0 insertions, 0 deletions