[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-Id: <20221203133159.94414-5-mailhol.vincent@wanadoo.fr>
Date: Sat, 3 Dec 2022 22:31:55 +0900
From: Vincent Mailhol <mailhol.vincent@...adoo.fr>
To: Marc Kleine-Budde <mkl@...gutronix.de>, linux-can@...r.kernel.org
Cc: Wolfgang Grandegger <wg@...ndegger.com>,
"David S . Miller" <davem@...emloft.net>,
Eric Dumazet <edumazet@...gle.com>,
Jakub Kicinski <kuba@...nel.org>,
Paolo Abeni <pabeni@...hat.com>,
Frank Jungclaus <frank.jungclaus@....eu>, socketcan@....eu,
Yasushi SHOJI <yashi@...cecubics.com>,
Stefan Mätje <stefan.maetje@....eu>,
Hangyu Hua <hbh25y@...il.com>,
Oliver Hartkopp <socketcan@...tkopp.net>,
Peter Fink <pfink@...ist-es.de>,
Jeroen Hofstee <jhofstee@...tronenergy.com>,
Christoph Möhring <cmoehring@...ist-es.de>,
John Whittington <git@...engineering.co.uk>,
Vasanth Sadhasivan <vasanth.sadhasivan@...sara.com>,
Jimmy Assarsson <extja@...ser.com>,
Anssi Hannula <anssi.hannula@...wise.fi>,
Pavel Skripkin <paskripkin@...il.com>,
Stephane Grosjean <s.grosjean@...k-system.com>,
Wolfram Sang <wsa+renesas@...g-engineering.com>,
"Gustavo A . R . Silva" <gustavoars@...nel.org>,
Julia Lawall <Julia.Lawall@...ia.fr>,
Dongliang Mu <dzm91@...t.edu.cn>,
Sebastian Haas <haas@...-wuensche.com>,
Maximilian Schneider <max@...neidersoft.net>,
Daniel Berglund <db@...ser.com>,
Olivier Sobrie <olivier@...rie.be>,
Remigiusz Kołłątaj
<remigiusz.kollataj@...ica.com>,
Jakob Unterwurzacher <jakob.unterwurzacher@...obroma-systems.com>,
Martin Elshuber <martin.elshuber@...obroma-systems.com>,
Philipp Tomsich <philipp.tomsich@...obroma-systems.com>,
Bernd Krumboeck <b.krumboeck@...il.com>,
netdev@...r.kernel.org, linux-kernel@...r.kernel.org,
Alan Stern <stern@...land.harvard.edu>,
linux-usb@...r.kernel.org,
Vincent Mailhol <mailhol.vincent@...adoo.fr>
Subject: [PATCH 4/8] can: kvaser_usb: kvaser_usb_disconnect(): fix NULL pointer dereference
kvaser_usb sets the usb_interface to NULL before waiting for the
completion of outstanding urbs. This can result in NULL pointer
dereference, c.f. [1] and [2].
Remove the call to usb_set_intfdata(intf, NULL). The core will take
care of setting it to NULL after kvaser_usb_disconnect() at [3].
[1] commit 27ef17849779 ("usb: add usb_set_intfdata() documentation")
Link: https://git.kernel.org/gregkh/usb/c/27ef17849779
[2] thread about usb_set_intfdata() on linux-usb mailing.
Link: https://lore.kernel.org/linux-usb/Y4OD70GD4KnoRk0k@rowland.harvard.edu/
[3] function usb_unbind_interface() from drivers/usb/core/driver.c
Link: https://elixir.bootlin.com/linux/v6.0/source/drivers/usb/core/driver.c#L497
Fixes: 080f40a6fa28 ("can: kvaser_usb: Add support for Kvaser CAN/USB devices")
Signed-off-by: Vincent Mailhol <mailhol.vincent@...adoo.fr>
---
@stable team: the function was moved from kvaser_usb.c to
kvaser_usb_core.c in:
7259124eac7d1 ("can: kvaser_usb: Split driver into kvaser_usb_core.c and kvaser_usb_leaf.c")
---
drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c | 2 --
1 file changed, 2 deletions(-)
diff --git a/drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c b/drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c
index 3a2bfaad1406..dad916b3288e 100644
--- a/drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c
+++ b/drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c
@@ -981,8 +981,6 @@ static void kvaser_usb_disconnect(struct usb_interface *intf)
{
struct kvaser_usb *dev = usb_get_intfdata(intf);
- usb_set_intfdata(intf, NULL);
-
if (!dev)
return;
--
2.37.4
Powered by blists - more mailing lists