> > Changbin, after looking more closely I realized there was a second > > aspect to this race: recursively_mark_NOTATTACHED uses hub->ports[i] > > while hub_disconnect removes the port devices. You ought to be able > > to cause an oops by inserting a delay just after the loop where > > usb_hub_remove_port_device is called. > > > > The updated patch below should fix both problems. Can you test it? > > > > Alan Stern > > > > Ok, I'll test it today or tomorrow. Please wait my response. Alan, I cannot cause a panic after inserting a delay just after usb_hub_remove_port_device is called, even move the delay after kfree(hub->ports). recursively_mark_NOTATTACHED will not access hub->ports[i] since maxchild has been set to 0. Alan, I think your last patch can fix this issue. -- To unsubscribe from this list: send the line "unsubscribe linux-usb" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
