queue-4.19/usb-rio500-refuse-more-than-one-device-at-a-time.patch

   1 From 3864d33943b4a76c6e64616280e98d2410b1190f Mon Sep 17 00:00:00 2001
   2 From: Oliver Neukum <oneukum@suse.com>
   3 Date: Thu, 9 May 2019 11:30:58 +0200
   4 Subject: USB: rio500: refuse more than one device at a time
   5
   6 From: Oliver Neukum <oneukum@suse.com>
   7
   8 commit 3864d33943b4a76c6e64616280e98d2410b1190f upstream.
   9
  10 This driver is using a global variable. It cannot handle more than
  11 one device at a time. The issue has been existing since the dawn
  12 of the driver.
  13
  14 Signed-off-by: Oliver Neukum <oneukum@suse.com>
  15 Reported-by: syzbot+35f04d136fc975a70da4@syzkaller.appspotmail.com
  16 Cc: stable <stable@vger.kernel.org>
  17 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  18
  19 ---
  20  drivers/usb/misc/rio500.c |   24 ++++++++++++++++++------
  21  1 file changed, 18 insertions(+), 6 deletions(-)
  22
  23 --- a/drivers/usb/misc/rio500.c
  24 +++ b/drivers/usb/misc/rio500.c
  25 @@ -447,15 +447,23 @@ static int probe_rio(struct usb_interfac
  26  {
  27         struct usb_device *dev = interface_to_usbdev(intf);
  28         struct rio_usb_data *rio = &rio_instance;
  29 -       int retval;
  30 +       int retval = 0;
  31
  32 -       dev_info(&intf->dev, "USB Rio found at address %d\n", dev->devnum);
  33 +       mutex_lock(&rio500_mutex);
  34 +       if (rio->present) {
  35 +               dev_info(&intf->dev, "Second USB Rio at address %d refused\n", dev->devnum);
  36 +               retval = -EBUSY;
  37 +               goto bail_out;
  38 +       } else {
  39 +               dev_info(&intf->dev, "USB Rio found at address %d\n", dev->devnum);
  40 +       }
  41
  42         retval = usb_register_dev(intf, &usb_rio_class);
  43         if (retval) {
  44                 dev_err(&dev->dev,
  45                         "Not able to get a minor for this device.\n");
  46 -               return -ENOMEM;
  47 +               retval = -ENOMEM;
  48 +               goto bail_out;
  49         }
  50
  51         rio->rio_dev = dev;
  52 @@ -464,7 +472,8 @@ static int probe_rio(struct usb_interfac
  53                 dev_err(&dev->dev,
  54                         "probe_rio: Not enough memory for the output buffer\n");
  55                 usb_deregister_dev(intf, &usb_rio_class);
  56 -               return -ENOMEM;
  57 +               retval = -ENOMEM;
  58 +               goto bail_out;
  59         }
  60         dev_dbg(&intf->dev, "obuf address:%p\n", rio->obuf);
  61
  62 @@ -473,7 +482,8 @@ static int probe_rio(struct usb_interfac
  63                         "probe_rio: Not enough memory for the input buffer\n");
  64                 usb_deregister_dev(intf, &usb_rio_class);
  65                 kfree(rio->obuf);
  66 -               return -ENOMEM;
  67 +               retval = -ENOMEM;
  68 +               goto bail_out;
  69         }
  70         dev_dbg(&intf->dev, "ibuf address:%p\n", rio->ibuf);
  71
  72 @@ -481,8 +491,10 @@ static int probe_rio(struct usb_interfac
  73
  74         usb_set_intfdata (intf, rio);
  75         rio->present = 1;
  76 +bail_out:
  77 +       mutex_unlock(&rio500_mutex);
  78
  79 -       return 0;
  80 +       return retval;
  81  }
  82
  83  static void disconnect_rio(struct usb_interface *intf)