summaryrefslogtreecommitdiffstats
path: root/drivers/usb/class
diff options
context:
space:
mode:
authorOliver Neukum <oneukum@suse.com>2020-05-07 10:58:06 +0200
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>2020-05-13 14:20:00 +0200
commit296a193b06120aa6ae7cf5c0d7b5e5b55968026e (patch)
treed9e0e467b616ffa7031cc9fb9a5d683e87926f80 /drivers/usb/class
parentsierra-ms: do not call scsi_get_host_dev() (diff)
downloadlinux-296a193b06120aa6ae7cf5c0d7b5e5b55968026e.tar.xz
linux-296a193b06120aa6ae7cf5c0d7b5e5b55968026e.zip
usblp: poison URBs upon disconnect
syzkaller reported an URB that should have been killed to be active. We do not understand it, but this should fix the issue if it is real. Signed-off-by: Oliver Neukum <oneukum@suse.com> Reported-by: syzbot+be5b5f86a162a6c281e6@syzkaller.appspotmail.com Link: https://lore.kernel.org/r/20200507085806.5793-1-oneukum@suse.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers/usb/class')
-rw-r--r--drivers/usb/class/usblp.c5
1 files changed, 4 insertions, 1 deletions
diff --git a/drivers/usb/class/usblp.c b/drivers/usb/class/usblp.c
index 0d8e3f3804a3..084c48c5848f 100644
--- a/drivers/usb/class/usblp.c
+++ b/drivers/usb/class/usblp.c
@@ -468,7 +468,8 @@ static int usblp_release(struct inode *inode, struct file *file)
usb_autopm_put_interface(usblp->intf);
if (!usblp->present) /* finish cleanup from disconnect */
- usblp_cleanup(usblp);
+ usblp_cleanup(usblp); /* any URBs must be dead */
+
mutex_unlock(&usblp_mutex);
return 0;
}
@@ -1375,9 +1376,11 @@ static void usblp_disconnect(struct usb_interface *intf)
usblp_unlink_urbs(usblp);
mutex_unlock(&usblp->mut);
+ usb_poison_anchored_urbs(&usblp->urbs);
if (!usblp->used)
usblp_cleanup(usblp);
+
mutex_unlock(&usblp_mutex);
}