lkml.org 
[lkml]   [2022]   [Apr]   [20]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
SubjectRe: [PATCH] driver: usb: nullify dangling pointer in cdc_ncm_free
From


On 20.04.22 08:56, Johan Hovold wrote:
>
>>
>> @@ -1214,7 +1214,7 @@ static const struct driver_info hawking_uf200_info = {
>> static const struct driver_info ax88772_info = {
>> .description = "ASIX AX88772 USB 2.0 Ethernet",
>> .bind = ax88772_bind,
>> - .unbind = ax88772_unbind,
>> + .unbind = ax88772_disable,
> These should all be
>
> .disable = ...
Thanks, noted.
>
> but you probably need to split the callback and keep unbind as well for
> the actual clean up (freeing resources etc).
That is the driver the problematic commit was requested for.
I am looking into it.
>
>> - if (dev->driver_info->unbind)
>> - dev->driver_info->unbind(dev, intf);
>> + if (dev->driver_info->disable)
>> + dev->driver_info->disable(dev, intf);
>>
>> net = dev->net;
>> unregister_netdev (net);
>> @@ -1651,6 +1651,9 @@ void usbnet_disconnect (struct usb_interface *intf)
>>
>> usb_scuttle_anchored_urbs(&dev->deferred);
>>
>> + if (dev->driver_info->unbind)
>> + dev->driver_info->unbind (dev, intf);
>> +
>> usb_kill_urb(dev->interrupt);
> Don't you need to quiesce all I/O, including stopping the interrupt URB,
> before unbind?
If I do that, how do I prevent people from relaunching the URB between
kill and unbind? Do I need to poison it?

    Regards
        Oliver

\
 
 \ /
  Last update: 2022-04-20 11:47    [W:0.085 / U:0.032 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site