Re: [PATCH] driver: usb: nullify dangling pointer in cdc_ncm_free

Oliver Neukum
2022-04-20T09:46:14Z

On 20.04.22 08:56, Johan Hovold wrote:
>
>>
>> @@ -1214,7 +1214,7 @@ static const struct driver_info hawking_uf200_info = {
>> static const struct driver_info ax88772_info = {
>> .description = "ASIX AX88772 USB 2.0 Ethernet",
>> .bind = ax88772_bind,
>> - .unbind = ax88772_unbind,
>> + .unbind = ax88772_disable,
> These should all be
>
> .disable = ...
Thanks, noted.
>
> but you probably need to split the callback and keep unbind as well for
> the actual clean up (freeing resources etc).
That is the driver the problematic commit was requested for.
I am looking into it.
>
>> - if (dev->driver_info->unbind)
>> - dev->driver_info->unbind(dev, intf);
>> + if (dev->driver_info->disable)
>> + dev->driver_info->disable(dev, intf);
>>
>> net = dev->net;
>> unregister_netdev (net);
>> @@ -1651,6 +1651,9 @@ void usbnet_disconnect (struct usb_interface *intf)
>>
>> usb_scuttle_anchored_urbs(&dev->deferred);
>>
>> + if (dev->driver_info->unbind)
>> + dev->driver_info->unbind (dev, intf);
>> +
>> usb_kill_urb(dev->interrupt);
> Don't you need to quiesce all I/O, including stopping the interrupt URB,
> before unbind?
If I do that, how do I prevent people from relaunching the URB between
kill and unbind? Do I need to poison it?

Regards
Oliver