> On 12/26/2015 04:57 AM, changbin.du@xxxxxxxxx wrote:
> > From: "Du, Changbin" <changbin.du@xxxxxxxxx>
> >
> > If acm_bind fails before allocate notification and acm->notify_req is
> > not set to NULL after freed last time, double free will happen.
>
> Looks good to me.
>
> Similar problem can occur with another USB functions (at least f_ecm,
> f_ncm, f_rndis and f_hid handle USB requests in analogical way). Maybe
> it's worth to fix them all at once?
>
> >
> > kernel BUG at mm/slub.c:3392!
> > invalid opcode: 0000 [#1] PREEMPT SMP
> > EIP is at kfree+0x172/0x180
> > Call Trace:
> > [<80c0e3b6>] ? usb_ep_autoconfig_ss+0x86/0x170
> > [<80c13345>] gs_free_req+0x15/0x30
> > [<80c12df1>] acm_bind+0x1c1/0x2d0
> > [<80c0e9be>] usb_add_function+0x6e/0x120
> > [<80c213cb>] acm_function_bind_config+0x2b/0x90
> >
>
> Reviewed-by: Robert Baldyga <r.baldyga@xxxxxxxxxxxxx>
>
Hmm, you are right. I checked all the fucntions, found these need to be fixed:
f_ecm.c f_hid.c f_ncm.c f_phonet.c f_rndis.c f_uvc.c
I will update patche to fix them all. thank you.
Regards,
Du, Changbin
��.n��������+%������w��{.n�����{���)�� jg��� �����ݢj����G���� ���j:+v���w�m������w�������h�����٥
