From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755946AbcE0BiX (ORCPT ); Thu, 26 May 2016 21:38:23 -0400 Received: from mailout4.samsung.com ([203.254.224.34]:47609 "EHLO mailout4.samsung.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1755869AbcE0BiV (ORCPT ); Thu, 26 May 2016 21:38:21 -0400 X-AuditID: cbfee691-f79196d000001483-a3-5747a50a869e Date: Fri, 27 May 2016 01:38:18 +0000 (GMT) From: Chung-Geol Kim Subject: [PATCH] usb: core: fix a double free in the usb driver To: "gregkh@linuxfoundation.org" , "mathias.nyman@linux.intel.com" , "stefan.koch10@gmail.com" , "hkallweit1@gmail.com" , "sergei.shtylyov@cogentembedded.com" , "dan.j.williams@intel.com" , "sarah.a.sharp@linux.intel.com" , "stern@rowland.harvard.edu" , "chris.bainbridge@gmail.com" Cc: "linux-usb@vger.kernel.org" , "linux-kernel@vger.kernel.org" Reply-to: chunggeol.kim@samsung.com MIME-version: 1.0 X-MTR: 20160527013636181@chunggeol.kim Msgkey: 20160527013636181@chunggeol.kim X-EPLocale: ko_KR.euc-kr X-Priority: 3 X-EPWebmail-Msg-Type: personal X-EPWebmail-Reply-Demand: 0 X-EPApproval-Locale: X-EPHeader: ML X-MLAttribute: X-RootMTR: 20160527013636181@chunggeol.kim X-ParentMTR: X-ArchiveUser: EV X-CPGSPASS: Y X-ConfirmMail: N,general Content-type: text/plain; charset=euc-kr MIME-version: 1.0 Message-id: <1060192669.191661464313093233.JavaMail.weblogic@epmlwas08d> X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFtrEJsWRmVeSWpSXmKPExsVy+t8zHV2upe7hBk3XxC0u75rD5sDo8XmT XABjVAOjTUpqTmZZapG+nU1iUXIGkKmQmpecn5KZl26rFBripmuhpJCRX1xiqxRtZGCsZ2Rq omdkYq5naRBrZWSqpJCXmJtqq1ShC9WrpFCUXABUm1tZDDQgJ1UPKq5XnJqX4pCVXwpyk15x Ym5xaV66XnJ+rlLCfMaMia0H2QqeiFa0/zvL3sA4Q7SLkZNDSEBD4lRTNwuILSFgIvHrXi8z hC0mceHeerYuRi6gmmWMEtMu/mCCKdp3qZMZIjGHUeLnipmsIAkWAVWJH/v2sYHYbAKGEqv/ 3AebJCxgL3Fl9QJ2kAYRgZUsEvunv2cESTAL1EjMfPOcFeIMZYm5dx6zg9i8AoISJ2c+gTpJ TeLPgSssEHF1iSfrmtkh4hISs6ZfYIWweSVmtD+FqpeTmPZ1DdQL0hLnZ21ghHln8ffHUHF+ iWO3d0B9IyAx9cxBoBoOIFtb4urzCIgwn8SahW+hRgpKnL7WzQyzqmHjb7gTtrY8YYV4RVFi SvdDdghbS+LLD0g4IHuFV8BD4ntXJxtE7xUOifkLvScwKs1CUjYLyahZSEYhq1nAyLKKUTS1 ILmgOCm9yBQ5kjcxQlLhxB2M9w9YH2JU52CUEi3NK05OzMtLTMpJjc9NzEnLL8pNTVHi4WVw dg8XYk0sK67MPcSYDIy9icxSosn5wPScVxJvaGxmZGFqYmpsZG5phiFsYmphYWKEQ1hJnFdH +mewkEB6YklqdmpqQWpRfFFpTmrxIUYmDk6pBsaAXu95c8tn5dyMYvpX9sVjVuSpcznP17MJ 7FS+tz555czrctlCMxQ3bruhuFPt7ayts49tmzSFx4Dt9iXbpddbw+56rw6OjLf8lqyvv0Hl donGU4lOT8ayLW35ue9fvnu+I6LyecXJWzPKkj3zdil/6jeva3E9LP76zc4V/Z1HDrx5eZQ9 zX+nEktxRqKhFnNRcSIAuR/O1sUDAAA= X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFvrGKsWRmVeSWpSXmKPExsVy+t/tPl2upe7hBv+mi1hc3jWHzYHR4/Mm uQDGqCKblNSczLLUIn07m4zUxJTUIoXUvOT8lMy8dFsl7+B453hTMwNDXUNLC3MlhbzE3FRb JRefAF23zByg8UoKZYk5pUChgMTiYiWgCUX5pSWpChn5xSW2StFGBsZ6RqYmekbGBnomBrFW hgYGRqZAVQlFGRNbD7IVPBGtaP93lr2BcYZoFyMnh5CAhsSppm4WEFtCwERi36VOZghbTOLC vfVsXYxcQDVzGCV+rpjJCpJgEVCV+LFvHxuIzSZgKLH6z32wBmEBe4krqxewgzSICKxkkdg/ /T0jSIJZoEZi5pvnrBDblCXm3nnMDmLzCghKnJz5BGqzmsSfA1dYIOLqEk/WNbNDxCUkZk2/ wAph80rMaH8KVS8nMe3rGqhLpSXOz9rACHP14u+PoeL8Esdu72CCsAUkpp45CFTDAWRrS1x9 HgER5pNYs/At1EhBidPXuplhVjVs/A13wtaWJ6wQryhKTOl+yA5ha0l8+QEJB2Sv8Ap4SHzv 6mSbwCg7C0lqFpL2WUjakdUsYGRZxSiaWpBcUJyUXmGoV5yYW1yal66XnJ+7iRGcoJ4t3MH4 5bz1IUZ1DkYp0dK84uTEvLzEpJzU+NzEnLT8otzUFCUe3ogJ7uFCrIllxZW5hxhVgFY92rD6 AqMUS15+XqqSCC/PEqA0b0piZVVqUX58UWlOavEhRlNgxE5klhJNzgem4LySeENjA2NDQ0tz A1NDIwslcd6Av+vChATSE0tSs1NTC1KLYPqYODilGhjdwgPuKZl4GKUu3KfX1i7xbxLjRK1u ffZg1fq3sb7PmmR5Oavera7XPXptI2v4ZvX6/ZufzV+3eO2jD/4M1Se+3ZywTzmYO//0+Q1h Hs5X73xW8TV8Jp+RHuQ77WAFq87P35EfimINkrVOWRp9L8o5by/GxXT+YtWmI7cuV6g77N6f 47dg/S4lluKMREMt5qLiRADBJ+VliQMAAA== DLP-Filter: Pass X-CFilter-Loop: Reflected Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Transfer-Encoding: 8bit X-MIME-Autoconverted: from base64 to 8bit by mail.home.local id u4R1cYsh013268 There is a double free problem in the usb driver. This is caused by delayed deregister for scsi device. <*> at Insert USB Storage - USB bus #1 register usb_create_hcd (primary-kref==1) * primary-bandwidth_mutex(alloc)) usb_get_hcd (primary-kref==2) - USB bus #2 register usb_create_hcd (second-kref==1) * second-bandwidth_mutex==primary-bandwidth_mutex usb_get_hcd (second-kref==2) - scsi_device_get usb_get_hcd (second-kref==3) <*> at remove USB Storage (Normal) - scsi_device_put usb_put_hcd (second-kref==2) - USB bus #2 deregister usb_release_dev(second-kref==1) usb_release_dev(second-kref==0) -> hcd_release() - USB bus #1 deregister usb_release_dev(primary-kref==1) usb_release_dev(primary-kref==0) -> hcd_release() *(primary-bandwidth_mutex free) at remove USB Storage - USB bus #2 deregister usb_release_dev(second-kref==2) usb_release_dev(second-kref==1) - USB bus #1 deregister usb_release_dev(primary-kref==1) usb_release_dev(primary-kref==0) -> hcd_release() *(primary-bandwidth_mutex free) - scsi_device_put usb_put_hcd (second-kref==0) -> hcd_release(*) * at this, second->primary==0 therefore try to free the primary-bandwidth_mutex.(already freed) To fix this problem kfree(hcd->bandwidth_mutex); should be executed at only (hcd->primary_hcd==hcd). Signed-off-by: Chunggeol Kim --- drivers/usb/core/hcd.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/usb/core/hcd.c b/drivers/usb/core/hcd.c index 34b837a..60077f3 100644 --- a/drivers/usb/core/hcd.c +++ b/drivers/usb/core/hcd.c @@ -2608,7 +2608,7 @@ static void hcd_release(struct kref *kref) struct usb_hcd *hcd = container_of (kref, struct usb_hcd, kref); mutex_lock(&usb_port_peer_mutex); - if (usb_hcd_is_primary_hcd(hcd)) { + if (hcd == hcd->primary_hcd) { kfree(hcd->address0_mutex); kfree(hcd->bandwidth_mutex); } -- 1.7.9.5