• Alan Stern's avatar
    HID: usbhid: Fix race between usbhid_close() and usbhid_stop() · 0ed08fad
    Alan Stern authored
    The syzbot fuzzer discovered a bad race between in the usbhid driver
    between usbhid_stop() and usbhid_close().  In particular,
    usbhid_stop() does:
    
    	usb_free_urb(usbhid->urbin);
    	...
    	usbhid->urbin = NULL; /* don't mess up next start */
    
    and usbhid_close() does:
    
    	usb_kill_urb(usbhid->urbin);
    
    with no mutual exclusion.  If the two routines happen to run
    concurrently so that usb_kill_urb() is called in between the
    usb_free_urb() and the NULL assignment, it will access the
    deallocated urb structure -- a use-after-free bug.
    
    This patch adds a mutex to the usbhid private structure and uses it to
    enforce mutual exclusion of the usbhid_start(), usbhid_stop(),
    usbhid_open() and usbhid_close() callbacks.
    
    Reported-and-tested-by: syzbot+7bf5a7b0f0a1f9446f4c@syzkaller.appspotmail.com
    Signed-off-by: default avatarAlan Stern <stern@rowland.harvard.edu>
    CC: <stable@vger.kernel.org>
    Signed-off-by: default avatarJiri Kosina <jkosina@suse.cz>
    0ed08fad
hid-core.c 45.2 KB