]> git.itanic.dy.fi Git - linux-stable/commit
carl9170: fix misuse of device driver API
authorChristian Lamparter <chunkeey@gmail.com>
Sat, 8 Jun 2019 14:49:47 +0000 (16:49 +0200)
committerKalle Valo <kvalo@codeaurora.org>
Thu, 27 Jun 2019 17:46:47 +0000 (20:46 +0300)
commitfeb09b2933275a70917a869989ea2823e7356be8
treea1c02666398b991f4ba938fbe397f8858992ab8a
parentdf5c4150501ee7e86383be88f6490d970adcf157
carl9170: fix misuse of device driver API

This patch follows Alan Stern's recent patch:
"p54: Fix race between disconnect and firmware loading"

that overhauled carl9170 buggy firmware loading and driver
unbinding procedures.

Since the carl9170 code was adapted from p54 it uses the
same functions and is likely to have the same problem, but
it's just that the syzbot hasn't reproduce them (yet).

a summary from the changes (copied from the p54 patch):
 * Call usb_driver_release_interface() rather than
   device_release_driver().

 * Lock udev (the interface's parent) before unbinding the
   driver instead of locking udev->parent.

 * During the firmware loading process, take a reference
   to the USB interface instead of the USB device.

 * Don't take an unnecessary reference to the device during
   probe (and then don't drop it during disconnect).

and

 * Make sure to prevent use-after-free bugs by explicitly
   setting the driver context to NULL after signaling the
   completion.

Cc: <stable@vger.kernel.org>
Cc: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
drivers/net/wireless/ath/carl9170/usb.c