Messages in this thread | | | Date | Tue, 7 Jan 2014 10:34:49 -0500 (EST) | From | Alan Stern <> | Subject | RE: [PATCH] usb/core: fix NULL pointer dereference in recursively_mark_NOTATTACHED |
| |
On Tue, 7 Jan 2014, Du, ChangbinX wrote:
> > > Changbin, after looking more closely I realized there was a second > > > aspect to this race: recursively_mark_NOTATTACHED uses hub->ports[i] > > > while hub_disconnect removes the port devices. You ought to be able > > > to cause an oops by inserting a delay just after the loop where > > > usb_hub_remove_port_device is called. > > > > > > The updated patch below should fix both problems. Can you test it? > > > > > > Alan Stern > > > > > > > Ok, I'll test it today or tomorrow. Please wait my response. > > Alan, I cannot cause a panic after inserting a delay just after > usb_hub_remove_port_device is called, even move the delay after > kfree(hub->ports). recursively_mark_NOTATTACHED will not access > hub->ports[i] since maxchild has been set to 0. > > Alan, I think your last patch can fix this issue.
Okay, thanks for testing. I will submit the patch.
Alan Stern
| |