On Tue, 7 Jan 2014, Du, ChangbinX wrote: > > > Changbin, after looking more closely I realized there was a second > > > aspect to this race: recursively_mark_NOTATTACHED uses hub->ports[i] > > > while hub_disconnect removes the port devices. You ought to be able > > > to cause an oops by inserting a delay just after the loop where > > > usb_hub_remove_port_device is called. > > > > > > The updated patch below should fix both problems. Can you test it? > > > > > > Alan Stern > > > > > > > Ok, I'll test it today or tomorrow. Please wait my response. > > Alan, I cannot cause a panic after inserting a delay just after > usb_hub_remove_port_device is called, even move the delay after > kfree(hub->ports). recursively_mark_NOTATTACHED will not access > hub->ports[i] since maxchild has been set to 0. > > Alan, I think your last patch can fix this issue. Okay, thanks for testing. I will submit the patch. Alan Stern -- To unsubscribe from this list: send the line "unsubscribe linux-usb" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
