Messages in this thread | | | From | "Du, ChangbinX" <> | Subject | RE: [PATCH] usb/core: fix NULL pointer dereference in recursively_mark_NOTATTACHED | Date | Tue, 7 Jan 2014 09:16:42 +0000 |
| |
> > Changbin, after looking more closely I realized there was a second > > aspect to this race: recursively_mark_NOTATTACHED uses hub->ports[i] > > while hub_disconnect removes the port devices. You ought to be able > > to cause an oops by inserting a delay just after the loop where > > usb_hub_remove_port_device is called. > > > > The updated patch below should fix both problems. Can you test it? > > > > Alan Stern > > > > Ok, I'll test it today or tomorrow. Please wait my response.
Alan, I cannot cause a panic after inserting a delay just after usb_hub_remove_port_device is called, even move the delay after kfree(hub->ports). recursively_mark_NOTATTACHED will not access hub->ports[i] since maxchild has been set to 0.
Alan, I think your last patch can fix this issue.
| |