lkml.org 
[lkml]   [2022]   [Dec]   [3]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 1/8] can: ems_usb: ems_usb_disconnect(): fix NULL pointer dereference
    Date
    ems_usb sets the usb_interface to NULL before waiting for the
    completion of outstanding urbs. This can result in NULL pointer
    dereference, c.f. [1] and [2].

    Remove the call to usb_set_intfdata(intf, NULL). The core will take
    care of setting it to NULL after ems_usb_disconnect() at [3].

    [1] commit 27ef17849779 ("usb: add usb_set_intfdata() documentation")
    Link: https://git.kernel.org/gregkh/usb/c/27ef17849779

    [2] thread about usb_set_intfdata() on linux-usb mailing.
    Link: https://lore.kernel.org/linux-usb/Y4OD70GD4KnoRk0k@rowland.harvard.edu/

    [3] function usb_unbind_interface() from drivers/usb/core/driver.c
    Link: https://elixir.bootlin.com/linux/v6.0/source/drivers/usb/core/driver.c#L497

    Fixes: 702171adeed3 ("ems_usb: Added support for EMS CPC-USB/ARM7 CAN/USB interface")
    Signed-off-by: Vincent Mailhol <mailhol.vincent@wanadoo.fr>
    ---
    drivers/net/can/usb/ems_usb.c | 2 --
    1 file changed, 2 deletions(-)

    diff --git a/drivers/net/can/usb/ems_usb.c b/drivers/net/can/usb/ems_usb.c
    index 050c0b49938a..c64cb40ac8de 100644
    --- a/drivers/net/can/usb/ems_usb.c
    +++ b/drivers/net/can/usb/ems_usb.c
    @@ -1062,8 +1062,6 @@ static void ems_usb_disconnect(struct usb_interface *intf)
    {
    struct ems_usb *dev = usb_get_intfdata(intf);

    - usb_set_intfdata(intf, NULL);
    -
    if (dev) {
    unregister_netdev(dev->netdev);

    --
    2.37.4
    \
     
     \ /
      Last update: 2022-12-03 14:32    [W:2.510 / U:0.044 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site