• Christian Lamparter's avatar
    carl9170: fix misuse of device driver API · 9e0150f6
    Christian Lamparter authored
    commit feb09b29 upstream.
    
    This patch follows Alan Stern's recent patch:
    "p54: Fix race between disconnect and firmware loading"
    
    that overhauled carl9170 buggy firmware loading and driver
    unbinding procedures.
    
    Since the carl9170 code was adapted from p54 it uses the
    same functions and is likely to have the same problem, but
    it's just that the syzbot hasn't reproduce them (yet).
    
    a summary from the changes (copied from the p54 patch):
     * Call usb_driver_release_interface() rather than
       device_release_driver().
    
     * Lock udev (the interface's parent) before unbinding the
       driver instead of locking udev->parent.
    
     * During the firmware loading process, take a reference
       to the USB interface instead of the USB device.
    
     * Don't take an unnecessary reference to the device during
       probe (and then don't drop it during disconnect).
    
    and
    
     * Make sure to prevent use-after-free bugs by explicitly
       setting the driver context to NULL after signaling the
       completion.
    
    Cc: <stable@vger.kernel.org>
    Cc: Alan Stern <stern@rowland.harvard.edu>
    Signed-off-by: default avatarChristian Lamparter <chunkeey@gmail.com>
    Acked-by: default avatarAlan Stern <stern@rowland.harvard.edu>
    Signed-off-by: default avatarKalle Valo <kvalo@codeaurora.org>
    Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
    9e0150f6
usb.c 26.3 KB