lkml.org 
[lkml]   [2008]   [Dec]   [5]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
From
Subject[PATCH] p54usb: fix usb_kill_urb hang with slub_debug=P
Date
This patch fixes a problem identified by Johannes Berg.

It looks like this is a classic case of "use-after-freed".
A module which should reproduce the problem on
any other USB device can be found right here:
http://kerneltrap.org/mailarchive/linux-usb/2008/12/4/4317064

Tested-by: Johannes Berg <johannes@sipsolutions.net>
Signed-off-by: Christian Lamparter <chunkeey@web.de>
CC: stable@vger.kernel.org
---
diff --git a/drivers/net/wireless/p54/p54usb.c b/drivers/net/wireless/p54/p54usb.c
index 3444f52..0b9a922 100644
--- a/drivers/net/wireless/p54/p54usb.c
+++ b/drivers/net/wireless/p54/p54usb.c
@@ -209,7 +209,14 @@ static void p54u_free_urbs(struct ieee80211_hw *dev)
if (!info->urb)
continue;

+ /*
+ * usb_get_urb and usb_free_urb are part of a temporary
+ * workaround. Otherwise we get a pretty bad freeze,
+ * if SLUB's poisoning debug option is enabled.
+ */
+ usb_get_urb(info->urb);
usb_kill_urb(info->urb);
+ usb_free_urb(info->urb);
kfree_skb(skb);
}
}


\
 
 \ /
  Last update: 2008-12-05 15:51    [W:0.395 / U:0.020 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site