Messages in this thread | | | Date | Thu, 16 Mar 2023 19:09:10 +0100 | From | Greg KH <> | Subject | Re: [PATCH v6] usb: gadget: udc: renesas_usb3: Fix use after free bug in renesas_usb3_remove due to race condition |
| |
On Fri, Mar 17, 2023 at 01:54:57AM +0800, Zheng Wang wrote: > In renesas_usb3_probe, role_work is bound with renesas_usb3_role_work. > renesas_usb3_start will be called to start the work. > > If we remove the driver which will call usbhs_remove, there may be > an unfinished work. The possible sequence is as follows: > > Fix it by canceling the work before cleanup in the renesas_usb3_remove. > > Note that removing a driver is a root-only operation, and should never > happen. > > CPU0 CPU1 > > | renesas_usb3_role_work > renesas_usb3_remove | > usb_role_switch_unregister| > device_unregister | > kfree(sw) | > free usb3->role_sw | > | usb_role_switch_set_role > | //use usb3->role_sw
Please use spaces for this, as something went wrong and it does not line up :(
| |