Johan Hovold bd658119e9 USB: legousbtower: fix use-after-free on release ...

commit 726b55d0e2 upstream.

The driver was accessing its struct usb_device in its release()
callback without holding a reference. This would lead to a
use-after-free whenever the device was disconnected while the character
device was still open.

Fixes: fef526cae7 ("USB: legousbtower: remove custom debug macro")
Cc: stable <stable@vger.kernel.org>     # 3.12
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://lore.kernel.org/r/20191009153848.8664-5-johan@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2019-10-17 13:42:41 -07:00

..

sisusbvga

…

adutux.c

USB: adutux: fix use-after-free on release

2019-10-17 13:42:36 -07:00

appledisplay.c

…

chaoskey.c

USB: chaoskey: fix use-after-free on release

2019-10-17 13:42:36 -07:00

cypress_cy7c63.c

…

cytherm.c

…

ehset.c

…

emi26.c

…

emi62.c

…

ezusb.c

…

ftdi-elan.c

…

idmouse.c

…

iowarrior.c

USB: iowarrior: fix use-after-free after driver unbind

2019-10-17 13:42:36 -07:00

isight_firmware.c

…

Kconfig

USB: rio500: Remove Rio 500 kernel driver

2019-10-17 13:42:26 -07:00

ldusb.c

USB: ldusb: fix NULL-derefs on driver unbind

2019-10-17 13:42:37 -07:00

legousbtower.c

USB: legousbtower: fix use-after-free on release

2019-10-17 13:42:41 -07:00

lvstest.c

…

Makefile

USB: rio500: Remove Rio 500 kernel driver

2019-10-17 13:42:26 -07:00

trancevibrator.c

…

ucsi.c

…

ucsi.h

…

usb3503.c

…

usb4604.c

…

usb_u132.h

…

usblcd.c

USB: usblcd: fix I/O after disconnect

2019-10-17 13:42:38 -07:00

usbsevseg.c

…

usbtest.c

…

uss720.c

…

yurex.c

USB: yurex: fix NULL-derefs on disconnect

2019-10-17 13:42:28 -07:00