Re: [PATCH] driver: usb: nullify dangling pointer in cdc_ncm_free

[Oliver Neukum]

On 20.04.22 08:56, Johan Hovold wrote:
>
>>  
>> @@ -1214,7 +1214,7 @@ static const struct driver_info hawking_uf200_info = {
>>  static const struct driver_info ax88772_info = {
>>  	.description = "ASIX AX88772 USB 2.0 Ethernet",
>>  	.bind = ax88772_bind,
>> -	.unbind = ax88772_unbind,
>> +	.unbind = ax88772_disable,
> These should all be
>
> 	.disable = ...
Thanks, noted.
>
> but you probably need to split the callback and keep unbind as well for
> the actual clean up (freeing resources etc).
That is the driver the problematic commit was requested for.
I am looking into it.
>
>> -	if (dev->driver_info->unbind)
>> -		dev->driver_info->unbind(dev, intf);
>> +	if (dev->driver_info->disable)
>> +		dev->driver_info->disable(dev, intf);
>>  
>>  	net = dev->net;
>>  	unregister_netdev (net);
>> @@ -1651,6 +1651,9 @@ void usbnet_disconnect (struct usb_interface *intf)
>>  
>>  	usb_scuttle_anchored_urbs(&dev->deferred);
>>  
>> +	if (dev->driver_info->unbind)
>> +		dev->driver_info->unbind (dev, intf);
>> +
>>  	usb_kill_urb(dev->interrupt);
> Don't you need to quiesce all I/O, including stopping the interrupt URB,
> before unbind?
If I do that, how do I prevent people from relaunching the URB between
kill and unbind? Do I need to poison it?

    Regards
        Oliver