Attachment 309142 Details for Bug 450786 – Alan Stern's 2nd patch backported to 2.6.18

[patch] Alan Stern's 2nd patch backported to 2.6.18

linux-2.6-usb-usbdev_read-null-pointer-dereference.patch (text/plain), 2.92 KB, created by Robert N. Evans on 2008-06-12 20:48:36 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Robert N. Evans

Created: 2008-06-12 20:48:36 UTC

Size: 2.92 KB

patch

obsolete

>diff -Naur linux-2.6.18.x86_64/drivers/usb/core/devio.c linux-2.6.18-92.el5_with_usbdev_fix_02/drivers/usb/core/devio.c
>--- linux-2.6.18.x86_64/drivers/usb/core/devio.c	2008-06-12 18:43:04.000000000 +0000
>+++ linux-2.6.18-92.el5_with_usbdev_fix_02/drivers/usb/core/devio.c	2008-06-12 18:26:07.000000000 +0000
>@@ -1579,6 +1579,27 @@
> 	.release =	usbdev_release,
> };
> 
>+void usb_fs_classdev_common_remove(struct usb_device *udev)
>+{
>+	struct dev_state *ps;
>+	struct siginfo sinfo;
>+
>+	while (!list_empty(&udev->filelist)) {
>+		ps = list_entry(udev->filelist.next, struct dev_state, list);
>+		wake_up_all(&ps->wait);
>+		list_del_init(&ps->list);
>+		if (ps->discsignr) {
>+			sinfo.si_signo = ps->discsignr;
>+			sinfo.si_errno = EPIPE;
>+			sinfo.si_code = SI_ASYNCIO;
>+			sinfo.si_addr = ps->disccontext;
>+			kill_proc_info_as_uid(ps->discsignr, &sinfo,
>+					ps->disc_pid, ps->disc_uid,
>+					ps->disc_euid, ps->secid);
>+		}
>+	}
>+}
>+
> static void usbdev_add(struct usb_device *dev)
> {
> 	int minor = ((dev->bus->busnum-1) * 128) + (dev->devnum-1);
>@@ -1593,6 +1614,7 @@
> static void usbdev_remove(struct usb_device *dev)
> {
> 	class_device_unregister(dev->class_dev);
>+	usb_fs_classdev_common_remove(dev);
> }
> 
> static int usbdev_notify(struct notifier_block *self, unsigned long action,
>diff -Naur linux-2.6.18.x86_64/drivers/usb/core/inode.c linux-2.6.18-92.el5_with_usbdev_fix_02/drivers/usb/core/inode.c
>--- linux-2.6.18.x86_64/drivers/usb/core/inode.c	2008-06-12 18:42:59.000000000 +0000
>+++ linux-2.6.18-92.el5_with_usbdev_fix_02/drivers/usb/core/inode.c	2008-06-12 18:35:37.000000000 +0000
>@@ -682,25 +682,11 @@
> 
> static void usbfs_remove_device(struct usb_device *dev)
> {
>-	struct dev_state *ds;
>-	struct siginfo sinfo;
>-
> 	if (dev->usbfs_dentry) {
> 		fs_remove_file (dev->usbfs_dentry);
> 		dev->usbfs_dentry = NULL;
> 	}
>-	while (!list_empty(&dev->filelist)) {
>-		ds = list_entry(dev->filelist.next, struct dev_state, list);
>-		wake_up_all(&ds->wait);
>-		list_del_init(&ds->list);
>-		if (ds->discsignr) {
>-			sinfo.si_signo = ds->discsignr;
>-			sinfo.si_errno = EPIPE;
>-			sinfo.si_code = SI_ASYNCIO;
>-			sinfo.si_addr = ds->disccontext;
>-			kill_proc_info_as_uid(ds->discsignr, &sinfo, ds->disc_pid, ds->disc_uid, ds->disc_euid, ds->secid);
>-		}
>-	}
>+	usb_fs_classdev_common_remove(dev);
> }
> 
> static int usbfs_notify(struct notifier_block *self, unsigned long action, void *dev)
>diff -Naur linux-2.6.18.x86_64/drivers/usb/core/usb.h linux-2.6.18-92.el5_with_usbdev_fix_02/drivers/usb/core/usb.h
>--- linux-2.6.18.x86_64/drivers/usb/core/usb.h	2008-06-12 18:42:56.000000000 +0000
>+++ linux-2.6.18-92.el5_with_usbdev_fix_02/drivers/usb/core/usb.h	2008-06-12 18:37:59.000000000 +0000
>@@ -64,6 +64,7 @@
> extern struct file_operations usbfs_devices_fops;
> extern struct file_operations usbfs_device_file_operations;
> extern void usbfs_conn_disc_event(void);
>+extern void usb_fs_classdev_common_remove(struct usb_device *udev);
> 
> extern int usbdev_init(void);
> extern void usbdev_cleanup(void);

Actions: View | Diff

Attachments on bug 450786: 308923 | 309101 | 309120 | 309142 | 309305 | 309692 | 310292 | 312710 | 312722 | 313707 | 313771