Commit c1846ed4 authored by Oliver Neukum's avatar Oliver Neukum Committed by Greg Kroah-Hartman
Browse files

USB: wdm: close race between wdm_open and wdm_wwan_port_stop 



Clearing WDM_WWAN_IN_USE must be the last action or
we can open a chardev whose URBs are still poisoned

Fixes: cac6fb01 ("usb: class: cdc-wdm: WWAN framework integration")
Cc: stable <stable@kernel.org>
Signed-off-by: default avatarOliver Neukum <oneukum@suse.com>
Link: https://lore.kernel.org/r/20250401084749.175246-3-oneukum@suse.com


Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 9697f5ef

drivers/usb/class/cdc-wdm.c

+4 −2
Original line number Diff line number Diff line
@@ -726,7 +726,7 @@ static int wdm_open(struct inode *inode, struct file *file) 
		rv = -EBUSY;

		goto out;

	}



	smp_rmb(); /* ordered against wdm_wwan_port_stop() */

	rv = usb_autopm_get_interface(desc->intf);

	if (rv < 0) {

		dev_err(&desc->intf->dev, "Error autopm - %d\n", rv);
@@ -868,8 +868,10 @@ static void wdm_wwan_port_stop(struct wwan_port *port) 
	poison_urbs(desc);

	desc->manage_power(desc->intf, 0);

	clear_bit(WDM_READ, &desc->flags);

	clear_bit(WDM_WWAN_IN_USE, &desc->flags);

	unpoison_urbs(desc);

	smp_wmb(); /* ordered against wdm_open() */

	/* this must be last lest we open a poisoned device */

	clear_bit(WDM_WWAN_IN_USE, &desc->flags);

}



static void wdm_wwan_port_tx_complete(struct urb *urb)