Messages in this thread Patch in this message |  | | From | Vincent Mailhol <> | Subject | [PATCH v2 4/9] can: kvaser_usb: kvaser_usb_disconnect(): fix NULL pointer dereference | Date | Sat, 10 Dec 2022 18:01:52 +0900 |
| |
kvaser_usb sets the driver's priv data to NULL before waiting for the completion of outsdanding urbs. This can results in NULL pointer dereference, c.f. [1] and [2].
Remove the call to usb_set_intfdata(intf, NULL). The core will take care of setting it to NULL after kvaser_usb_disconnect() at [3].
[1] c/27ef17849779 ("usb: add usb_set_intfdata() documentation") Link: https://git.kernel.org/gregkh/usb/c/27ef17849779
[2] thread about usb_set_intfdata() on linux-usb mailing. Link: https://lore.kernel.org/linux-usb/Y4OD70GD4KnoRk0k@rowland.harvard.edu/
[3] function usb_unbind_interface() from drivers/usb/core/driver.c Link: https://elixir.bootlin.com/linux/v6.0/source/drivers/usb/core/driver.c#L497
Fixes: 080f40a6fa28 ("can: kvaser_usb: Add support for Kvaser CAN/USB devices") Signed-off-by: Vincent Mailhol <mailhol.vincent@wanadoo.fr> --- @stable team: the function was moved from kvaser_usb.c to kvaser_usb_core.c in:
7259124eac7d1 ("can: kvaser_usb: Split driver into kvaser_usb_core.c and kvaser_usb_leaf.c") --- drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c | 2 -- 1 file changed, 2 deletions(-)
diff --git a/drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c b/drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c index 3a2bfaad1406..dad916b3288e 100644 --- a/drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c +++ b/drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c @@ -981,8 +981,6 @@ static void kvaser_usb_disconnect(struct usb_interface *intf) { struct kvaser_usb *dev = usb_get_intfdata(intf); - usb_set_intfdata(intf, NULL); - if (!dev) return; -- 2.37.4
|  |