[patch 1/2] usbhid: use after free

Subsystems: hid core layer, the rest, usb hid/hidbp drivers (usb keyboards, mice, remote controls, ...) · Maintainers: Jiri Kosina, Benjamin Tissoires, Linus Torvalds

STALE5633d

2 messages, 2 authors, 2011-05-26 · open the first message on its own page

[patch 1/2] usbhid: use after free

From: Dan Carpenter <hidden>
Date: 2011-05-26 08:49:16

There are a couple use after free bugs here.

Signed-off-by: Dan Carpenter <redacted>
---
Compile tested only.  Please review carefully.

diff --git a/drivers/hid/usbhid/hiddev.c b/drivers/hid/usbhid/hiddev.c
index ff3c644..b2f9a3a 100644
--- a/drivers/hid/usbhid/hiddev.c
+++ b/drivers/hid/usbhid/hiddev.c

@@ -248,12 +248,15 @@ static int hiddev_release(struct inode * inode, struct file * file)
 			usbhid_close(list->hiddev->hid);
 			usbhid_put_power(list->hiddev->hid);
 		} else {
+			mutex_unlock(&list->hiddev->existancelock);
 			kfree(list->hiddev);
+			kfree(list);
+			return 0;
 		}
 	}
 
-	kfree(list);
 	mutex_unlock(&list->hiddev->existancelock);
+	kfree(list);
 
 	return 0;
 }

@@ -926,7 +929,9 @@ void hiddev_disconnect(struct hid_device *hid)
 		usbhid_close(hiddev->hid);
 		wake_up_interruptible(&hiddev->wait);
 	} else {
+		mutex_unlock(&hiddev->existancelock);
 		kfree(hiddev);
+		return;
 	}
 	mutex_unlock(&hiddev->existancelock);
 }
--

To unsubscribe from this list: send the line "unsubscribe linux-usb" in
the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Re: [patch 1/2] usbhid: use after free

From: Jiri Kosina <hidden>
Date: 2011-05-26 12:03:37

On Thu, 26 May 2011, Dan Carpenter wrote:

quoted hunk

There are a couple use after free bugs here.

Signed-off-by: Dan Carpenter <redacted>
---
Compile tested only.  Please review carefully.

diff --git a/drivers/hid/usbhid/hiddev.c b/drivers/hid/usbhid/hiddev.c
index ff3c644..b2f9a3a 100644
--- a/drivers/hid/usbhid/hiddev.c
+++ b/drivers/hid/usbhid/hiddev.c

@@ -248,12 +248,15 @@ static int hiddev_release(struct inode * inode, struct file * file)
 			usbhid_close(list->hiddev->hid);
 			usbhid_put_power(list->hiddev->hid);
 		} else {
+			mutex_unlock(&list->hiddev->existancelock);
 			kfree(list->hiddev);
+			kfree(list);
+			return 0;
 		}
 	}
 
-	kfree(list);
 	mutex_unlock(&list->hiddev->existancelock);
+	kfree(list);

Good catch.

quoted hunk

 	return 0;
 }

@@ -926,7 +929,9 @@ void hiddev_disconnect(struct hid_device *hid)
 		usbhid_close(hiddev->hid);
 		wake_up_interruptible(&hiddev->wait);
 	} else {
+		mutex_unlock(&hiddev->existancelock);
 		kfree(hiddev);
+		return;
 	}
 	mutex_unlock(&hiddev->existancelock);

For this I already have a fix queued in my tree.

So I will be applying only the first hunk.

Thanks,

-- 
Jiri Kosina
SUSE Labs

`h`	back out one level
`j`	next message in thread
`k`	previous message in thread
`l`	drill in
`Esc`	close help / fold thread tree
`?`	toggle this help