possible race in usb_disable_device()

[Oliver Neukum <oliver@xxxxxxxxxx>]

Hi,

it looks like this code in usb_disable_device():

	if (dev->actconfig) {
		for (i = 0; i < dev->actconfig->desc.bNumInterfaces; i++) {
			struct usb_interface	*interface;

			/* remove this interface if it has been registered */
			interface = dev->actconfig->interface[i];
			if (!device_is_registered(&interface->dev))
				continue;
			dev_dbg(&dev->dev, "unregistering interface %s\n",
				dev_name(&interface->dev));
			interface->unregistering = 1;
			remove_intf_ep_devs(interface);
			device_del(&interface->dev);
		}

calls remove_intf_ep_devs() which eventually calls ep_device_release()
which calls kfree() before it notifies the drivers in
device_del(&interface->dev) that the device is gone. Comments?

	Regards
		Oliver

--
To unsubscribe from this list: send the line "unsubscribe linux-usb" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html