Commit 880de403 authored by Johan Hovold's avatar Johan Hovold Committed by Greg Kroah-Hartman
Browse files

USB: xhci: dbc: fix tty registration race 



Make sure to allocate resources before registering the tty device to
avoid having a racing open() and write() fail to enable rx or
dereference a NULL pointer when accessing the uninitialised fifo.

Fixes: dfba2174 ("usb: xhci: Add DbC support in xHCI driver")
Cc: stable@vger.kernel.org      # 4.16
Cc: Lu Baolu <baolu.lu@linux.intel.com>
Signed-off-by: default avatarJohan Hovold <johan@kernel.org>
Signed-off-by: default avatarMathias Nyman <mathias.nyman@linux.intel.com>
Link: https://lore.kernel.org/r/20211008092547.3996295-4-mathias.nyman@linux.intel.com


Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 5255660b

drivers/usb/host/xhci-dbgtty.c

+13 −15
Original line number Diff line number Diff line
@@ -408,40 +408,38 @@ static int xhci_dbc_tty_register_device(struct xhci_dbc *dbc) 
		return -EBUSY;



	xhci_dbc_tty_init_port(dbc, port);

	tty_dev = tty_port_register_device(&port->port,

					   dbc_tty_driver, 0, NULL);

	if (IS_ERR(tty_dev)) {

		ret = PTR_ERR(tty_dev);

		goto register_fail;

	}



	ret = kfifo_alloc(&port->write_fifo, DBC_WRITE_BUF_SIZE, GFP_KERNEL);

	if (ret)

		goto buf_alloc_fail;

		goto err_exit_port;



	ret = xhci_dbc_alloc_requests(dbc, BULK_IN, &port->read_pool,

				      dbc_read_complete);

	if (ret)

		goto request_fail;

		goto err_free_fifo;



	ret = xhci_dbc_alloc_requests(dbc, BULK_OUT, &port->write_pool,

				      dbc_write_complete);

	if (ret)

		goto request_fail;

		goto err_free_requests;



	tty_dev = tty_port_register_device(&port->port,

					   dbc_tty_driver, 0, NULL);

	if (IS_ERR(tty_dev)) {

		ret = PTR_ERR(tty_dev);

		goto err_free_requests;

	}



	port->registered = true;



	return 0;



request_fail:

err_free_requests:

	xhci_dbc_free_requests(&port->read_pool);

	xhci_dbc_free_requests(&port->write_pool);

err_free_fifo:

	kfifo_free(&port->write_fifo);



buf_alloc_fail:

	tty_unregister_device(dbc_tty_driver, 0);



register_fail:

err_exit_port:

	xhci_dbc_tty_exit_port(port);



	dev_err(dbc->dev, "can't register tty port, err %d\n", ret);