]> CyberLeo.Net >> Repos - FreeBSD/FreeBSD.git/commit
usb(4): Fix for use after free in combination with EVDEV_SUPPORT.
authorHans Petter Selasky <hselasky@FreeBSD.org>
Sun, 24 Oct 2021 11:38:04 +0000 (13:38 +0200)
committerHans Petter Selasky <hselasky@FreeBSD.org>
Wed, 3 Nov 2021 17:39:23 +0000 (18:39 +0100)
commit791f88fff31d8067ffbfc4f0670aff84f094549d
tree4e3b7f4c19e423cbe3200437ef7e54c15c300b89
parent5f6e6bef15dfe242a64e7f98ad5f53c7b0dd74e4
usb(4): Fix for use after free in combination with EVDEV_SUPPORT.

When EVDEV_SUPPORT was introduced, the USB transfers may be running
after the main FIFO is closed. In connection to this a race may appear
which can lead to use-after-free scenarios. Fix this for all FIFO
consumers by initializing and resetting the FIFO queues under the
lock used by the client. Then the client driver will see an empty
queue in all cases a race may appear.

Approved by: re@ (gjb)
Found by: pho@
Sponsored by: NVIDIA Networking

(cherry picked from commit aad0c65d6b37364d8ba92ecb8c85e004398a5194)
(cherry picked from commit bb9bee1ffbb27f903bfd2c11d681d331bea727ea)
sys/dev/usb/usb_dev.c