cdc_ncm: do not call usbnet_link_change from cdc_ncm_bind
authorBjørn Mork <bjorn@mork.no>
Fri, 15 Jul 2016 19:08:16 +0000 (15:08 -0400)
committerWilly Tarreau <w@1wt.eu>
Sun, 21 Aug 2016 21:22:36 +0000 (23:22 +0200)
commit82365cf607366c401a29bd19a4b0fb30783b1691
treee3fc77d8f376a59f3b3d60c716d667e66afdd47c
parentf474c525b4f412522cd092b6c8bffb6a0fd9a4de
cdc_ncm: do not call usbnet_link_change from cdc_ncm_bind

commit 4d06dd537f95683aba3651098ae288b7cbff8274 upstream.

usbnet_link_change will call schedule_work and should be
avoided if bind is failing. Otherwise we will end up with
scheduled work referring to a netdev which has gone away.

Instead of making the call conditional, we can just defer
it to usbnet_probe, using the driver_info flag made for
this purpose.

CVE-2016-3951

Fixes: 8a34b0ae8778 ("usbnet: cdc_ncm: apply usbnet_link_change")
Reported-by: Andrey Konovalov <andreyknvl@gmail.com>
Suggested-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Bjørn Mork <bjorn@mork.no>
Signed-off-by: David S. Miller <davem@davemloft.net>
[ciwillia@brocade.com: backported to 3.10: adjusted context]
Signed-off-by: Charles (Chas) Williams <ciwillia@brocade.com>
Signed-off-by: Willy Tarreau <w@1wt.eu>
drivers/net/usb/cdc_ncm.c