From: Vincent Mailhol <mailhol.vincent@wanadoo.fr>
To: Marc Kleine-Budde <mkl@pengutronix.de>, linux-can@vger.kernel.org
Cc: "Wolfgang Grandegger" <wg@grandegger.com>,
"David S . Miller" <davem@davemloft.net>,
"Eric Dumazet" <edumazet@google.com>,
"Jakub Kicinski" <kuba@kernel.org>,
"Paolo Abeni" <pabeni@redhat.com>,
"Frank Jungclaus" <frank.jungclaus@esd.eu>,
socketcan@esd.eu, "Yasushi SHOJI" <yashi@spacecubics.com>,
"Stefan Mätje" <stefan.maetje@esd.eu>,
"Hangyu Hua" <hbh25y@gmail.com>,
"Oliver Hartkopp" <socketcan@hartkopp.net>,
"Peter Fink" <pfink@christ-es.de>,
"Jeroen Hofstee" <jhofstee@victronenergy.com>,
"Christoph Möhring" <cmoehring@christ-es.de>,
"John Whittington" <git@jbrengineering.co.uk>,
"Vasanth Sadhasivan" <vasanth.sadhasivan@samsara.com>,
"Jimmy Assarsson" <extja@kvaser.com>,
"Anssi Hannula" <anssi.hannula@bitwise.fi>,
"Pavel Skripkin" <paskripkin@gmail.com>,
"Stephane Grosjean" <s.grosjean@peak-system.com>,
"Wolfram Sang" <wsa+renesas@sang-engineering.com>,
"Gustavo A . R . Silva" <gustavoars@kernel.org>,
"Julia Lawall" <Julia.Lawall@inria.fr>,
"Dongliang Mu" <dzm91@hust.edu.cn>,
"Sebastian Haas" <haas@ems-wuensche.com>,
"Maximilian Schneider" <max@schneidersoft.net>,
"Daniel Berglund" <db@kvaser.com>,
"Olivier Sobrie" <olivier@sobrie.be>,
"Remigiusz Kołłątaj" <remigiusz.kollataj@mobica.com>,
"Jakob Unterwurzacher"
<jakob.unterwurzacher@theobroma-systems.com>,
"Martin Elshuber" <martin.elshuber@theobroma-systems.com>,
"Philipp Tomsich" <philipp.tomsich@theobroma-systems.com>,
"Bernd Krumboeck" <b.krumboeck@gmail.com>,
netdev@vger.kernel.org, linux-kernel@vger.kernel.org,
"Alan Stern" <stern@rowland.harvard.edu>,
linux-usb@vger.kernel.org,
"Vincent Mailhol" <mailhol.vincent@wanadoo.fr>
Subject: [PATCH 4/8] can: kvaser_usb: kvaser_usb_disconnect(): fix NULL pointer dereference
Date: Sat, 3 Dec 2022 22:31:55 +0900 [thread overview]
Message-ID: <20221203133159.94414-5-mailhol.vincent@wanadoo.fr> (raw)
In-Reply-To: <20221203133159.94414-1-mailhol.vincent@wanadoo.fr>
kvaser_usb sets the usb_interface to NULL before waiting for the
completion of outstanding urbs. This can result in NULL pointer
dereference, c.f. [1] and [2].
Remove the call to usb_set_intfdata(intf, NULL). The core will take
care of setting it to NULL after kvaser_usb_disconnect() at [3].
[1] commit 27ef17849779 ("usb: add usb_set_intfdata() documentation")
Link: https://git.kernel.org/gregkh/usb/c/27ef17849779
[2] thread about usb_set_intfdata() on linux-usb mailing.
Link: https://lore.kernel.org/linux-usb/Y4OD70GD4KnoRk0k@rowland.harvard.edu/
[3] function usb_unbind_interface() from drivers/usb/core/driver.c
Link: https://elixir.bootlin.com/linux/v6.0/source/drivers/usb/core/driver.c#L497
Fixes: 080f40a6fa28 ("can: kvaser_usb: Add support for Kvaser CAN/USB devices")
Signed-off-by: Vincent Mailhol <mailhol.vincent@wanadoo.fr>
---
@stable team: the function was moved from kvaser_usb.c to
kvaser_usb_core.c in:
7259124eac7d1 ("can: kvaser_usb: Split driver into kvaser_usb_core.c and kvaser_usb_leaf.c")
---
drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c | 2 --
1 file changed, 2 deletions(-)
diff --git a/drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c b/drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c
index 3a2bfaad1406..dad916b3288e 100644
--- a/drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c
+++ b/drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c
@@ -981,8 +981,6 @@ static void kvaser_usb_disconnect(struct usb_interface *intf)
{
struct kvaser_usb *dev = usb_get_intfdata(intf);
- usb_set_intfdata(intf, NULL);
-
if (!dev)
return;
--
2.37.4
next prev parent reply other threads:[~2022-12-03 13:33 UTC|newest]
Thread overview: 28+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-12-03 13:31 [PATCH 0/8] can: usb: remove all usb_set_intfdata(intf, NULL) in drivers' disconnect() Vincent Mailhol
2022-12-03 13:31 ` [PATCH 1/8] can: ems_usb: ems_usb_disconnect(): fix NULL pointer dereference Vincent Mailhol
2022-12-03 13:31 ` [PATCH 2/8] can: esd_usb: esd_usb_disconnect(): " Vincent Mailhol
2022-12-03 13:31 ` [PATCH 3/8] can: gs_usb: gs_usb_disconnect(): " Vincent Mailhol
2022-12-03 13:31 ` Vincent Mailhol [this message]
2022-12-03 13:31 ` [PATCH 5/8] can: mcba_usb: mcba_usb_disconnect(): " Vincent Mailhol
2022-12-03 13:31 ` [PATCH 6/8] can: ucan: ucan_disconnect(): " Vincent Mailhol
2022-12-03 13:31 ` [PATCH 7/8] can: usb_8dev: usb_8dev_disconnect(): " Vincent Mailhol
2022-12-03 13:31 ` [PATCH 8/8] can: etas_es58x and peak_usb: remove useless call to usb_set_intfdata() Vincent Mailhol
2022-12-05 8:35 ` [PATCH 0/8] can: usb: remove all usb_set_intfdata(intf, NULL) in drivers' disconnect() Oliver Neukum
2022-12-08 9:00 ` Vincent MAILHOL
2022-12-08 10:55 ` Oliver Neukum
2022-12-08 15:44 ` Vincent MAILHOL
2022-12-08 16:28 ` Alan Stern
2022-12-08 16:51 ` Oliver Neukum
2022-12-10 9:02 ` Vincent MAILHOL
2022-12-10 9:01 ` [PATCH v2 0/9] " Vincent Mailhol
2022-12-10 9:01 ` [PATCH v2 1/9] can: ems_usb: ems_usb_disconnect(): fix NULL pointer dereference Vincent Mailhol
2022-12-10 10:59 ` Johan Hovold
2022-12-11 11:24 ` Vincent MAILHOL
2022-12-10 9:01 ` [PATCH v2 2/9] can: esd_usb: esd_usb_disconnect(): " Vincent Mailhol
2022-12-10 9:01 ` [PATCH v2 3/9] can: gs_usb: gs_usb_disconnect(): " Vincent Mailhol
2022-12-10 9:01 ` [PATCH v2 4/9] can: kvaser_usb: kvaser_usb_disconnect(): " Vincent Mailhol
2022-12-10 9:01 ` [PATCH v2 5/9] can: mcba_usb: mcba_usb_disconnect(): " Vincent Mailhol
2022-12-10 9:01 ` [PATCH v2 6/9] can: ucan: ucan_disconnect(): " Vincent Mailhol
2022-12-10 9:01 ` [PATCH v2 7/9] can: usb_8dev: usb_8dev_disconnect(): " Vincent Mailhol
2022-12-10 9:01 ` [PATCH v2 8/9] can: usb: remove useless check on driver data Vincent Mailhol
2022-12-10 9:01 ` [PATCH v2 9/9] can: etas_es58x and peak_usb: remove useless call to usb_set_intfdata() Vincent Mailhol
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20221203133159.94414-5-mailhol.vincent@wanadoo.fr \
--to=mailhol.vincent@wanadoo.fr \
--cc=Julia.Lawall@inria.fr \
--cc=anssi.hannula@bitwise.fi \
--cc=b.krumboeck@gmail.com \
--cc=cmoehring@christ-es.de \
--cc=davem@davemloft.net \
--cc=db@kvaser.com \
--cc=dzm91@hust.edu.cn \
--cc=edumazet@google.com \
--cc=extja@kvaser.com \
--cc=frank.jungclaus@esd.eu \
--cc=git@jbrengineering.co.uk \
--cc=gustavoars@kernel.org \
--cc=haas@ems-wuensche.com \
--cc=hbh25y@gmail.com \
--cc=jakob.unterwurzacher@theobroma-systems.com \
--cc=jhofstee@victronenergy.com \
--cc=kuba@kernel.org \
--cc=linux-can@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-usb@vger.kernel.org \
--cc=martin.elshuber@theobroma-systems.com \
--cc=max@schneidersoft.net \
--cc=mkl@pengutronix.de \
--cc=netdev@vger.kernel.org \
--cc=olivier@sobrie.be \
--cc=pabeni@redhat.com \
--cc=paskripkin@gmail.com \
--cc=pfink@christ-es.de \
--cc=philipp.tomsich@theobroma-systems.com \
--cc=remigiusz.kollataj@mobica.com \
--cc=s.grosjean@peak-system.com \
--cc=socketcan@esd.eu \
--cc=socketcan@hartkopp.net \
--cc=stefan.maetje@esd.eu \
--cc=stern@rowland.harvard.edu \
--cc=vasanth.sadhasivan@samsara.com \
--cc=wg@grandegger.com \
--cc=wsa+renesas@sang-engineering.com \
--cc=yashi@spacecubics.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).