Messages in this thread | | | Date | Thu, 20 Jan 2022 17:27:51 +0300 | Subject | Re: [PATCH] drivers: net: remove a dangling pointer in peak_usb_create_dev | From | Pavel Skripkin <> |
| |
Hi Dongliang,
On 1/20/22 16:05, Dongliang Mu wrote: > From: Dongliang Mu <mudongliangabcd@gmail.com> > > The error handling code of peak_usb_create_dev forgets to reset the > next_siblings of previous entry. > > Fix this by nullifying the (dev->prev_siblings)->next_siblings in the > error handling code. > > Signed-off-by: Dongliang Mu <mudongliangabcd@gmail.com> > --- > drivers/net/can/usb/peak_usb/pcan_usb_core.c | 3 +++ > 1 file changed, 3 insertions(+) > > diff --git a/drivers/net/can/usb/peak_usb/pcan_usb_core.c b/drivers/net/can/usb/peak_usb/pcan_usb_core.c > index b850ff8fe4bd..f858810221b6 100644 > --- a/drivers/net/can/usb/peak_usb/pcan_usb_core.c > +++ b/drivers/net/can/usb/peak_usb/pcan_usb_core.c > @@ -894,6 +894,9 @@ static int peak_usb_create_dev(const struct peak_usb_adapter *peak_usb_adapter, > dev->adapter->dev_free(dev); > > lbl_unregister_candev: > + /* remove the dangling pointer in next_siblings */ > + if (dev->prev_siblings) > + (dev->prev_siblings)->next_siblings = NULL; > unregister_candev(netdev); > > lbl_restore_intf_data:
Is this pointer used somewhere? I see, that couple of struct peak_usb_adapter::dev_free() functions use it, but peak_usb_disconnect() sets dev->next_siblings to NULL before calling ->dev_free().
Do you have a calltrace or oops log?
With regards, Pavel Skripkin
| |