mail archive of the barebox mailing list
 help / color / mirror / Atom feed
* [PATCH 1/2] USB: host: hub: Make sure to remove dangling pointers
@ 2018-08-29  6:33 Andrey Smirnov
  2018-08-29  6:33 ` [PATCH 2/2] USB: host: hub: Adjust device speed after every port reset Andrey Smirnov
  0 siblings, 1 reply; 3+ messages in thread
From: Andrey Smirnov @ 2018-08-29  6:33 UTC (permalink / raw)
  To: barebox; +Cc: Andrey Smirnov

When the call to usb_new_device() in usb_hub_port_connect_change()
fails and corresponding USB device is freed with usb_free_device(), we
need to make sure that the pointer to it stored in dev->children[port]
is removed as well, lest we risk usage-after-free.

This issue was observed when working with a device for which
usb_set_address() would fail and trying to do "usb" right afterwards.

Signed-off-by: Andrey Smirnov <andrew.smirnov@gmail.com>
---
 drivers/usb/core/hub.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
index f44aea55a..70f633ed8 100644
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -233,6 +233,7 @@ static void usb_hub_port_connect_change(struct usb_device *dev, int port)
 		dev_dbg(&dev->dev, "hub: disabling port %d\n", port + 1);
 		usb_clear_port_feature(dev, port + 1, USB_PORT_FEAT_ENABLE);
 		usb_free_device(usb);
+		dev->children[port] = NULL;
 		return;
 	}
 
-- 
2.17.1


_______________________________________________
barebox mailing list
barebox@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/barebox

^ permalink raw reply	[flat|nested] 3+ messages in thread

end of thread, other threads:[~2018-08-29  7:40 UTC | newest]

Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2018-08-29  6:33 [PATCH 1/2] USB: host: hub: Make sure to remove dangling pointers Andrey Smirnov
2018-08-29  6:33 ` [PATCH 2/2] USB: host: hub: Adjust device speed after every port reset Andrey Smirnov
2018-08-29  7:40   ` Sascha Hauer

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox