Re: [Report]: BUG: KASAN: use-after-free in usb_hcd_pci_remove

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Fri, Aug 14, 2020 at 09:07:20PM +0300, Andy Shevchenko wrote:
> On Fri, Aug 14, 2020 at 06:18:16PM +0100, John Garry wrote:

> > diff --git a/drivers/usb/core/hcd-pci.c b/drivers/usb/core/hcd-pci.c
> > index 4dc443aaef5c..44a8d3644973 100644
> > --- a/drivers/usb/core/hcd-pci.c
> > +++ b/drivers/usb/core/hcd-pci.c
> > @@ -346,9 +346,9 @@ void usb_hcd_pci_remove(struct pci_dev *dev)
> >  		dev_set_drvdata(&dev->dev, NULL);
> >  		up_read(&companions_rwsem);
> >  	}
> > -	usb_put_hcd(hcd);
> >  	if ((hcd->driver->flags & HCD_MASK) < HCD_USB3)
> >  		pci_free_irq_vectors(dev);
> > +	usb_put_hcd(hcd);
> 
> It's not correct approach.
> We need to copy flags to a temporary variable.
> I will send a new patch soon to test, thanks!

Just out of curiosity, can you explain what is wrong with John's 
approach?  The problem isn't obvious to me.

Alan Stern



[Index of Archives]     [Linux Media]     [Linux Input]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]     [Old Linux USB Devel Archive]

  Powered by Linux