Alan Stern 0a2314035c USB: Fix race condition when removing host controllers
This patch (as1607) fixes a race that can occur if a USB host
controller is removed while a process is reading the
/sys/kernel/debug/usb/devices file.

The usb_device_read() routine uses the bus->root_hub pointer to
determine whether or not the root hub is registered.  The is not a
valid test, because the pointer is set before the root hub gets
registered and remains set even after the root hub is unregistered and
deallocated.  As a result, usb_device_read() or usb_device_dump() can
access freed memory, causing an oops.

The patch changes the test to use the hcd->rh_registered flag, which
does get set and cleared at the appropriate times.  It also makes sure
to hold the usb_bus_list_lock mutex while setting the flag, so that
usb_device_read() will become aware of new root hubs as soon as they
are registered.

Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Reported-by: Don Zickus <dzickus@redhat.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2012-09-26 10:21:08 -07:00
..
2012-08-02 13:51:46 -04:00
2012-09-16 20:42:46 -07:00
2012-08-17 09:21:35 +02:00
2012-08-13 10:15:22 +05:30
2012-07-29 21:11:05 -03:00
2012-07-30 09:32:39 -07:00
2012-08-13 14:34:02 +08:00
2012-09-04 13:58:11 -04:00
2012-09-13 16:37:52 -04:00
2012-08-27 17:07:37 -07:00
2012-08-28 10:08:31 +02:00
2012-07-31 08:16:22 -06:00
2012-07-31 08:16:22 -06:00