[Bug 220052] The usb/cdc-acm driver uses memory after it is freed

[bugzilla-daemon@kernel.org]

https://bugzilla.kernel.org/show_bug.cgi?id=220052

--- Comment #2 from Ben (ben.maan@aimvalley.com) ---
One of our customers complained about a kernel panic that occurs now and than
after disconnecting a usb-cable. However, most of the disconnects are without a
panic. After some investigation the panic shows up between 1 and 100 disconnect
attempts. From the panic output can be seen that the acm_softint is one of the
last functions on the stack . This function is first calling a usb_kill_urb
that frees the urb memory but 2 lines further the allocated urb memory is still
used in the acm_submit_read_urbs->acm_submit_read_urb.

Exchanging the 2 lines as indicated in the patch solves the problem completely
and the kernel panic is not seen anymore. This is proved by 7000 'virtual'
disconnects.

-- 
You may reply to this email to add a comment.

You are receiving this mail because:
You are watching the assignee of the bug.