lkml.org 
[lkml]   [2023]   [Mar]   [16]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: [PATCH v5] usb: gadget: udc: renesas_usb3: Fix use after free bug in renesas_usb3_remove due to race condition
    On Thu, Mar 16, 2023 at 11:56:45PM +0800, Zheng Wang wrote:
    > In renesas_usb3_probe, &usb3->role_work is bound with
    > renesas_usb3_role_work. renesas_usb3_start will be called
    > to start the work.

    You have a full 72 columns to write in, please use them :)

    >
    > If we remove the driver which will call usbhs_remove, there may be
    > an unfinished work. The possible sequence is as follows:
    >
    > Fix it by canceling the work before cleanup in the renesas_usb3_remove.
    >
    > CPU0 CPU1
    >
    > |renesas_usb3_role_work
    > renesas_usb3_remove |
    > usb_role_switch_unregister |
    > device_unregister |
    > kfree(sw) |
    > free usb3->role_sw |
    > | usb_role_switch_set_role
    > | //use usb3->role_sw

    Why can't this be written so it looks better:

    CPU0 CPU1

    | renesas_usb3_role_work
    renesas_usb3_remove |
    usb_role_switch_unregister |
    device_unregister |
    kfree(sw) |
    free usb3->role_sw |
    | usb_role_switch_set_role
    | // use usb3->role_sw

    Note that removing a driver is a root-only operation, and should never
    happen so please also say that.

    thanks,

    greg k-h

    \
     
     \ /
      Last update: 2023-03-27 01:04    [W:2.564 / U:0.020 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site