RE: [PATCH] usb: gadget: acm: set notify_req to NULL after freed to avoid double free

[Du, Changbin]

> On 12/26/2015 04:57 AM, changbin.du@xxxxxxxxx wrote:
> > From: "Du, Changbin" <changbin.du@xxxxxxxxx>
> >
> > If acm_bind fails before allocate notification and acm->notify_req is
> > not set to NULL after freed last time, double free will happen.
> 
> Looks good to me.
> 
> Similar problem can occur with another USB functions (at least f_ecm,
> f_ncm, f_rndis and f_hid handle USB requests in analogical way). Maybe
> it's worth to fix them all at once?
> 
> >
> > kernel BUG at mm/slub.c:3392!
> > invalid opcode: 0000 [#1] PREEMPT SMP
> > EIP is at kfree+0x172/0x180
> > Call Trace:
> > [<80c0e3b6>] ? usb_ep_autoconfig_ss+0x86/0x170
> > [<80c13345>] gs_free_req+0x15/0x30
> > [<80c12df1>] acm_bind+0x1c1/0x2d0
> > [<80c0e9be>] usb_add_function+0x6e/0x120
> > [<80c213cb>] acm_function_bind_config+0x2b/0x90
> >
> 
> Reviewed-by: Robert Baldyga <r.baldyga@xxxxxxxxxxxxx>
>
Hmm, you are right. I checked all the fucntions, found these need to be fixed:
f_ecm.c f_hid.c f_ncm.c f_phonet.c f_rndis.c f_uvc.c

I will update patche to fix them all. thank you.

Regards,
Du, Changbin