UPSTREAM: USB: cdc-wdm: remove from device list on disconnect

Prevents dereferencing an invalid struct usb_interface
pointer.

Always delete entry from device list whether or not the
rest of the device state cleanup is postponed. The device
list uses desc->intf as key, and wdm_open will dereference
this key while searching for a matching device.  A device
should not appear in the list unless probe() has succeeded
and disconnect() has not finished.

Cc: Oliver Neukum <oliver@neukum.org>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Bjørn Mork <bjorn@mork.no>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit 6286d85e8efdb59252d1ceb99a56fa6b0b11526c)

Change-Id: I3e46779ed124230465be74f61d81363d3f218870
Signed-off-by: Ben Chan <benchan@chromium.org>
Reviewed-on: https://gerrit.chromium.org/gerrit/35156
Reviewed-by: Olof Johansson <olofj@chromium.org>

diff --git a/drivers/usb/class/cdc-wdm.c b/drivers/usb/class/cdc-wdm.c
index 90bc916..631bb95 100644 (file)
--- a/drivers/usb/class/cdc-wdm.c
+++ b/drivers/usb/class/cdc-wdm.c
@@ -309,9 +309,6 @@ static void free_urbs(struct wdm_device *desc)
 
 static void cleanup(struct wdm_device *desc)
 {
-       spin_lock(&wdm_device_list_lock);
-       list_del(&desc->device_list);
-       spin_unlock(&wdm_device_list_lock);
        kfree(desc->sbuf);
        kfree(desc->inbuf);
        kfree(desc->orq);
@@ -782,6 +779,9 @@ static int wdm_create(struct usb_interface *intf, struct usb_endpoint_descriptor
 out:
        return rv;
 err:
+       spin_lock(&wdm_device_list_lock);
+       list_del(&desc->device_list);
+       spin_unlock(&wdm_device_list_lock);
        cleanup(desc);
        return rv;
 }
@@ -907,6 +907,12 @@ static void wdm_disconnect(struct usb_interface *intf)
        cancel_work_sync(&desc->rxwork);
        mutex_unlock(&desc->wlock);
        mutex_unlock(&desc->rlock);
+
+       /* the desc->intf pointer used as list key is now invalid */
+       spin_lock(&wdm_device_list_lock);
+       list_del(&desc->device_list);
+       spin_unlock(&wdm_device_list_lock);
+
        if (!desc->count)
                cleanup(desc);
        else