[Bug 220052] The usb/cdc-acm driver uses memory after it is freed

[bugzilla-daemon@kernel.org]

https://bugzilla.kernel.org/show_bug.cgi?id=220052

--- Comment #4 from oneukum@suse.com ---
On 30.04.25 14:56, bugzilla-daemon@kernel.org wrote:

> Exchanging the 2 lines as indicated in the patch solves the problem
> completely
> and the kernel panic is not seen anymore. This is proved by 7000 'virtual'
> disconnects.
> 

Yes, it solves your particular problem.

Now, with your patch, you first call
acm_submit_read_urbs() -> acm_submit_read_urb():

res = usb_submit_urb(acm->read_urbs[index], mem_flags);

And then you do

+                       for (i = 0; i < acm->rx_buflimit; i++)
+                               usb_kill_urb(acm->read_urbs[i]);

In other words, you undo what you just did.

Your diagnosis of the issue may be good, but the fix is _not_.
The purpose of acm_softint() is to

1. kill outstanding IO
2. error handling with usb_clear_halt()
3. restart the outstanding IO

You cannot reverse steps 1 and 3 and expect that to work.
The issue must be one of refcounting.

        Sorry
                Oliver

-- 
You may reply to this email to add a comment.

You are receiving this mail because:
You are watching the assignee of the bug.