diff options
| author | Alexander Shishkin <alexander.shishkin@linux.intel.com> | 2012-09-12 14:48:31 +0300 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2012-09-12 10:00:51 -0700 |
| commit | 1f2235b8e79bd276f19809f7f2a270f55909d695 (patch) | |
| tree | 98c25c71a5db781442af70ae350d904b232dd159 /net/9p | |
| parent | 58efc77c86af5cb81d7d7ea0c3c3e675e7d121dc (diff) | |
usb: move children deallocation after quiescing the hub
Commit ff823c79a5c33194c2e5594f7c4686ea3547910c ("usb: move children
to struct usb_port") forgot to consider the hub_disconnect sequence,
which releases ports before quiescing the hub, which will lead to a
use-after-free, since hub_quiesce() will try to disconnect ports'
children, which are already deallocated. Simple modprobe dummy_hcd &&
rmmod dummy_hcd will illustrate the problem.
This patch moves deallocation of hub's ports after hub_quiesce() call
in hub_disconnect().
Cc: Lan Tianyu <tianyu.lan@intel.com>
Signed-off-by: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'net/9p')
0 files changed, 0 insertions, 0 deletions