lkml.org 
[lkml]   [2013]   [Dec]   [26]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
SubjectRE: [PATCH] usb/core: fix NULL pointer dereference in recursively_mark_NOTATTACHED
Date
> > On Tue, 24 Dec 2013, Alan Stern wrote:
> > I think this will fix it. Take a close look and do some careful testing.
> >
> > Alan Stern
> >
> > Index: usb-3.13/drivers/usb/core/hub.c
> >
> ==========================================================
> > --- usb-3.13.orig/drivers/usb/core/hub.c
> > +++ usb-3.13/drivers/usb/core/hub.c
> > @@ -1622,11 +1622,14 @@ static void hub_disconnect(struct usb_in
> > hub->error = 0;
> > hub_quiesce(hub, HUB_DISCONNECT);
> >
> > - usb_set_intfdata (intf, NULL);
> > -
> > for (i = 0; i < hdev->maxchild; i++)
> > usb_hub_remove_port_device(hub, i + 1);
> > +
> > + /* Avoid races with recursively_mark_NOTATTACHED() */
> > + spin_lock_irq(&device_state_lock);
> > hub->hdev->maxchild = 0;
> > + usb_set_intfdata(intf, NULL);
> > + spin_unlock_irq(&device_state_lock);
> >
> > if (hub->hdev->speed == USB_SPEED_HIGH)
> > highspeed_hubs--;
> >
>
> Sorry for late response. Agree with you. I will test your patch carefully and
> let you know the result. Thanks!

I can reproduce issue by adding a delay just after usb_set_intfdata(intf, NULL)
(echo -1 > bConfigurationValue to trigger hub_dissconnect())without your patch.

After patch applied, cannot reproduce and didn't found any other issue. Patch works well.

Alan, need I update patch to v2 or you will do it?

Du, Changbin


\
 
 \ /
  Last update: 2013-12-26 10:41    [W:0.072 / U:0.508 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site