lkml.org 
[lkml]   [2014]   [Jun]   [17]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [PATCH] USB: EHCI: tegra: Fix use-after-free in .remove()
On Tue, 17 Jun 2014, Stephen Warren wrote:

> On 06/17/2014 08:17 AM, Tuomas Tynkkynen wrote:
> > The tegra_ehci_hcd structure is located in the private space allocated
> > by the core USB code so it must not be accessed after the HCD is
> > freed.
>
> > diff --git a/drivers/usb/host/ehci-tegra.c b/drivers/usb/host/ehci-tegra.c
>
> This seems to be a persistent problem. Witness commit ecc8a0cdca18 "usb:
> host: tegra: fix warning messages in ehci_remove". So, I wonder if ...
>
> > @@ -479,10 +479,11 @@ static int tegra_ehci_remove(struct platform_device *pdev)
> >
> > usb_phy_shutdown(hcd->phy);
> > usb_remove_hcd(hcd);
> > - usb_put_hcd(hcd);
> >
> > clk_disable_unprepare(tegra->clk);
> >
>
> It's worth putting a comment here:
>
> /* This must be last, since *tegra is part of *hcd */
> > + usb_put_hcd(hcd);
> > +
> > return 0;
> > }

Well, maybe. At this stage it's not too likely that anything will be
added after the usb_put_hcd().

> Of course, that could be a separate commit if you want.

This affects more than ehci-tegra. The same concept applies to all the
EHCI and OHCI platform drivers that use the platform-private area.

Alan Stern



\
 
 \ /
  Last update: 2014-06-17 22:21    [W:0.572 / U:0.824 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site