USB: cdc-acm: fix sysfs attribute registration bug

This patch (as950) fixes a bug in the cdc-acm driver.  It doesn't keep
track of which interface (control or data) the sysfs attributes get
registered for, and as a result, during disconnect it will sometimes
attempt to remove the attributes from the wrong interface.  The
left-over attributes can cause a crash later on, particularly if the driver
module has been unloaded.

Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Acked-by: Oliver Neukum <oneukum@suse.de>
Cc: stable <stable@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

1 files changed, 9 insertions, 3 deletions

diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
index fe940e0536e0..f51e22490edf 100644
--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -921,6 +921,10 @@ skip_normal_probe:
                         return -EINVAL;
                 }
         }
+
+        /* Accept probe requests only for the control interface */
+        if (intf != control_interface)
+                return -ENODEV;
         
         if (usb_interface_claimed(data_interface)) { /* valid in this context */
                 dev_dbg(&intf->dev,"The data interface isn't available");
@@ -1109,10 +1113,12 @@ static void acm_disconnect(struct usb_interface *intf)
                 return;
         }
         if (acm->country_codes){
-                device_remove_file(&intf->dev, &dev_attr_wCountryCodes);
-                device_remove_file(&intf->dev, &dev_attr_iCountryCodeRelDate);
+                device_remove_file(&acm->control->dev,
+                                &dev_attr_wCountryCodes);
+                device_remove_file(&acm->control->dev,
+                                &dev_attr_iCountryCodeRelDate);
         }
-        device_remove_file(&intf->dev, &dev_attr_bmCapabilities);
+        device_remove_file(&acm->control->dev, &dev_attr_bmCapabilities);
         acm->dev = NULL;
         usb_set_intfdata(acm->control, NULL);
         usb_set_intfdata(acm->data, NULL);