lkml.org 
[lkml]   [2023]   [Mar]   [16]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    From
    Date
    SubjectRe: [PATCH v3] usb: gadget: udc: renesas_usb3: Fix use after free bug in renesas_usb3_remove due to race condition
    Greg KH <gregkh@linuxfoundation.org> 于2023年3月16日周四 18:55写道:
    >
    > On Tue, Mar 14, 2023 at 12:51:28AM +0800, Zheng Wang wrote:
    > > In renesas_usb3_probe, &usb3->role_work is bound with
    > > renesas_usb3_role_work. renesas_usb3_start will be called
    > > to start the work.
    > >
    > > If we remove the driver which will call usbhs_remove, there may be
    > > an unfinished work. The possible sequence is as follows:
    > >
    > > Fix it by canceling the work before cleanup in the renesas_usb3_remove
    > >
    > > CPU0 CPU1
    > >
    > > |renesas_usb3_role_work
    > > renesas_usb3_remove |
    > > usb_role_switch_unregister |
    > > device_unregister |
    > > kfree(sw) |
    > > free usb3->role_sw |
    > > | usb_role_switch_set_role
    > > | //use usb3->role_sw
    > >
    > > Fixes: 39facfa01c9f ("usb: gadget: udc: renesas_usb3: Add register of usb role switch")
    > > Reviewed-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
    > > Signed-off-by: Zheng Wang <zyytlz.wz@163.com>
    > > ---
    > > v3:
    > > - modify the commit message to make it clearer suggested by Yoshihiro Shimoda
    >
    > I see 2 v3 patches in the mailing list, which is obviously not correct.
    >
    > Please resubmit a v4 properly.
    >

    Hi Greg,

    Thanks for your kind reminder. I'll resubmit a v4 patch later.

    Best regards,
    Zheng

    > thanks,
    >
    > greg k-h

    \
     
     \ /
      Last update: 2023-03-27 01:04    [W:2.800 / U:0.312 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site