From patchwork Sat Dec 10 09:01:50 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Vincent MAILHOL X-Patchwork-Id: 633225 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7A940C4708D for ; Sat, 10 Dec 2022 09:03:55 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229972AbiLJJDu (ORCPT ); Sat, 10 Dec 2022 04:03:50 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:45728 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229821AbiLJJDN (ORCPT ); Sat, 10 Dec 2022 04:03:13 -0500 Received: from mail-pj1-x102b.google.com (mail-pj1-x102b.google.com [IPv6:2607:f8b0:4864:20::102b]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 7AEA01572D; Sat, 10 Dec 2022 01:03:02 -0800 (PST) Received: by mail-pj1-x102b.google.com with SMTP id u15-20020a17090a3fcf00b002191825cf02so7395147pjm.2; Sat, 10 Dec 2022 01:03:02 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:sender:from:to:cc:subject:date :message-id:reply-to; bh=4DVtAm9qztHyZBrD4ZVLrTHR+RA9lfulcIIjDcTmdPQ=; b=OrMCEYGTR/LDfFd3lfYST1dGQLTy+XYi+8lUHZpCR3sTtLTf9kTtLnjsWuiCo/yJFV upDwACLmxAWYT2a2lDQHD9aJCiX07KYRm1ryqAEJcDgYAaLlO1b0Ut7lEJXdHK4Wc0Q+ T9UZxu5xe7+iN8wgO0VYDOZdP1RkyW4xPt+lACxYtk25rywKEo3T449w25za9Dw1Ym0U 4199KBxpnuhbsBLtatH8bMSnJwxlnShphA6Z1EM5Yaw/3Pdw/OeyjtDDfmrXiHHRlom7 z8PZvK98RQSU5VFhJoQVrZp6HVuqnA2VlPdLiqZmAHZVdQ2RMdKbFdv/cXl3HKiMQmnz ZaOg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:sender:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=4DVtAm9qztHyZBrD4ZVLrTHR+RA9lfulcIIjDcTmdPQ=; b=BxDSPqddc7mdnKRysFiF9b3UN5z28wXOwASur1R8f+u7EGjIb2YJC+uZxC4aajP2SU KHmZVV5YzGbmmamyfhP/VrUFEbNPI0BdIlzq7ba3JOC76Q/1MpRqMyb/qU7wjKHxM9KM 4mmEUfT1A8I2n0s1lXPFuJt9TTcGencX7hIPk5pzi36Dl5Vxv8s5imaz4dtWZkhX09JG jwURAA9jsZ74dWDu2wRCRo7zAx6EhwBJCP77ProKQigZAOOPi0T+fgFrqCRUNBnZ9k6Y LtF50NEsD2ug3AHD4u8aqlzVjgCdIo4daZ378ReWY6H+L+Ed+HskLQJ1SvmTmONyqU8M +GPQ== X-Gm-Message-State: ANoB5pkTU0dJLoqXda/nKA/BzO1p+Y9BrYawh7GsE3nVHy16CSgj4HQK Y1LMtxUY6/8qHr+ax5ce38I= X-Google-Smtp-Source: AA0mqf4b370FMGctMLWBPB42Vhi2lbTxMKKU0lVOWD3OfcHBPeOclpu1y2MyDCcrZyPg9S/evE3B7g== X-Received: by 2002:a05:6a20:28a0:b0:ad:58d4:2a7a with SMTP id q32-20020a056a2028a000b000ad58d42a7amr484019pzf.22.1670662982080; Sat, 10 Dec 2022 01:03:02 -0800 (PST) Received: from localhost.localdomain (124x33x176x97.ap124.ftth.ucom.ne.jp. [124.33.176.97]) by smtp.gmail.com with ESMTPSA id u7-20020a17090282c700b00186a2444a43sm2549481plz.27.2022.12.10.01.02.55 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 10 Dec 2022 01:03:01 -0800 (PST) Sender: Vincent Mailhol From: Vincent Mailhol To: Marc Kleine-Budde , linux-can@vger.kernel.org Cc: Oliver Neukum , Wolfgang Grandegger , "David S . Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Frank Jungclaus , socketcan@esd.eu, Yasushi SHOJI , =?utf-8?q?Stefan_M=C3=A4tje?= , Hangyu Hua , Oliver Hartkopp , Peter Fink , Jeroen Hofstee , =?utf-8?q?Christoph_M=C3=B6hring?= , John Whittington , Vasanth Sadhasivan , Jimmy Assarsson , Anssi Hannula , Pavel Skripkin , Stephane Grosjean , Wolfram Sang , "Gustavo A . R . Silva" , Julia Lawall , Dongliang Mu , Sebastian Haas , Maximilian Schneider , Daniel Berglund , Olivier Sobrie , =?utf-8?b?UmVtaWdpdXN6IEtvxYLFgsSFdGFq?= , Jakob Unterwurzacher , Martin Elshuber , Bernd Krumboeck , netdev@vger.kernel.org, linux-kernel@vger.kernel.org, Alan Stern , linux-usb@vger.kernel.org, Vincent Mailhol Subject: [PATCH v2 2/9] can: esd_usb: esd_usb_disconnect(): fix NULL pointer dereference Date: Sat, 10 Dec 2022 18:01:50 +0900 Message-Id: <20221210090157.793547-3-mailhol.vincent@wanadoo.fr> X-Mailer: git-send-email 2.37.4 In-Reply-To: <20221210090157.793547-1-mailhol.vincent@wanadoo.fr> References: <20221203133159.94414-1-mailhol.vincent@wanadoo.fr> <20221210090157.793547-1-mailhol.vincent@wanadoo.fr> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: linux-usb@vger.kernel.org esd_usb sets the driver's priv data to NULL before waiting for the completion of outsdanding urbs. This can results in NULL pointer dereference, c.f. [1] and [2]. Remove the call to usb_set_intfdata(intf, NULL). The core will take care of setting it to NULL after esd_usb_disconnect() at [3]. [1] c/27ef17849779 ("usb: add usb_set_intfdata() documentation") Link: https://git.kernel.org/gregkh/usb/c/27ef17849779 [2] thread about usb_set_intfdata() on linux-usb mailing. Link: https://lore.kernel.org/linux-usb/Y4OD70GD4KnoRk0k@rowland.harvard.edu/ [3] function usb_unbind_interface() from drivers/usb/core/driver.c Link: https://elixir.bootlin.com/linux/v6.0/source/drivers/usb/core/driver.c#L497 Fixes: 96d8e90382dc ("can: Add driver for esd CAN-USB/2 device") Signed-off-by: Vincent Mailhol --- @stable team: the file was renamed from esd_usb2.c to esd_usb.c in [4]. [4] 5e910bdedc84 ("can/esd_usb2: Rename esd_usb2.c to esd_usb.c") --- drivers/net/can/usb/esd_usb.c | 2 -- 1 file changed, 2 deletions(-) diff --git a/drivers/net/can/usb/esd_usb.c b/drivers/net/can/usb/esd_usb.c index 81b88e9e5bdc..f3006c6dc5d6 100644 --- a/drivers/net/can/usb/esd_usb.c +++ b/drivers/net/can/usb/esd_usb.c @@ -1127,8 +1127,6 @@ static void esd_usb_disconnect(struct usb_interface *intf) device_remove_file(&intf->dev, &dev_attr_hardware); device_remove_file(&intf->dev, &dev_attr_nets); - usb_set_intfdata(intf, NULL); - if (dev) { for (i = 0; i < dev->net_count; i++) { if (dev->nets[i]) { From patchwork Sat Dec 10 09:01:52 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Vincent MAILHOL X-Patchwork-Id: 633224 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id B982CC4332F for ; Sat, 10 Dec 2022 09:04:30 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230016AbiLJJEY (ORCPT ); Sat, 10 Dec 2022 04:04:24 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:46244 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229907AbiLJJDS (ORCPT ); Sat, 10 Dec 2022 04:03:18 -0500 Received: from mail-pj1-x1036.google.com (mail-pj1-x1036.google.com [IPv6:2607:f8b0:4864:20::1036]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 2E46CB7; Sat, 10 Dec 2022 01:03:17 -0800 (PST) Received: by mail-pj1-x1036.google.com with SMTP id fy4so6920491pjb.0; Sat, 10 Dec 2022 01:03:17 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:sender:from:to:cc:subject:date :message-id:reply-to; bh=/1fa7mtks0N/WurNaTfmwfwJgDz/Tqfo6okS65bthdQ=; b=AQHUYbtOoW5Gne7fhhw+e8Pt4UFlo9+Nu4vpgd5hs5WV7Dg2+6E/HXimOsYcnS/MNa bONTYfrBLOjF/6xcYMtEEuBAsng7ZzR0upwS9cCuyiZn6BRedyqNzOMoYjr83bMnmQ8a FrOSxWHiy4R5qxakm5/uIYaZoPuGeSHxNxA5gi5rlqUJ84+2i4E3Qn0aFxSuZCfqA0ZJ xY2+Tx4JZP11JslSBX0xvsmIvaQFnx2nPnO2fME3mPKelYpnrJ52B90nWUJelDXfTnVY olkrMaqbYXOUyyKvS/w9/e6ctCeVVZC3++jZ2IVd69dDJFHv07bQPnhJ7Xj8fOUGAVCz GwHg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:sender:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=/1fa7mtks0N/WurNaTfmwfwJgDz/Tqfo6okS65bthdQ=; b=s2SvjQAHsh0LLDSzgS92XJ1nv0mynazQvY3dsyf76rdF9akSRSqO8qPWhWHXIfzhI2 Shh0hRjxEkRUVWQ7OOxm8jGfQeBqHuknUBQCCmIBE2aWPkjoXMUdI8PxgUsxjE0o7yWE IpzbAQsanNVS6kGeVdZbKK0dBaJLoA4iXV4HcrWjkJTgLyQYp5A6lLH2arkJHKwcyBWN Yk+cbZHmmnBq2vOafvDlOE1GgHTZkeKX7PvADXaQZmLUtPNl3GfZcS3QQ7Tj0tNimkjG 1I+RvzEW54svW1PlVoXnk0mIhHBUrMBQHk49TyJUVympNw9ig2pn2WdUjWmpHEvhYnCS 2Rew== X-Gm-Message-State: ANoB5pk5G3mzxX3aqNqD2vj04zTrb8KYTWVKsxvWA59Aq2LRNGFo5NAB qhyfip0o8gSsEjmd9OanjyA= X-Google-Smtp-Source: AA0mqf6cwDtpJ2vszh+ZzDEn0dKGGcq/YPifGaOTVRf4SeuJE5E8MJgxMGnS5xVQzz+YG/2s1smO0Q== X-Received: by 2002:a17:902:ab07:b0:189:529d:a464 with SMTP id ik7-20020a170902ab0700b00189529da464mr8592241plb.17.1670662996607; Sat, 10 Dec 2022 01:03:16 -0800 (PST) Received: from localhost.localdomain (124x33x176x97.ap124.ftth.ucom.ne.jp. [124.33.176.97]) by smtp.gmail.com with ESMTPSA id u7-20020a17090282c700b00186a2444a43sm2549481plz.27.2022.12.10.01.03.09 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 10 Dec 2022 01:03:16 -0800 (PST) Sender: Vincent Mailhol From: Vincent Mailhol To: Marc Kleine-Budde , linux-can@vger.kernel.org Cc: Oliver Neukum , Wolfgang Grandegger , "David S . Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Frank Jungclaus , socketcan@esd.eu, Yasushi SHOJI , =?utf-8?q?Stefan_M=C3=A4tje?= , Hangyu Hua , Oliver Hartkopp , Peter Fink , Jeroen Hofstee , =?utf-8?q?Christoph_M=C3=B6hring?= , John Whittington , Vasanth Sadhasivan , Jimmy Assarsson , Anssi Hannula , Pavel Skripkin , Stephane Grosjean , Wolfram Sang , "Gustavo A . R . Silva" , Julia Lawall , Dongliang Mu , Sebastian Haas , Maximilian Schneider , Daniel Berglund , Olivier Sobrie , =?utf-8?b?UmVtaWdpdXN6IEtvxYLFgsSFdGFq?= , Jakob Unterwurzacher , Martin Elshuber , Bernd Krumboeck , netdev@vger.kernel.org, linux-kernel@vger.kernel.org, Alan Stern , linux-usb@vger.kernel.org, Vincent Mailhol Subject: [PATCH v2 4/9] can: kvaser_usb: kvaser_usb_disconnect(): fix NULL pointer dereference Date: Sat, 10 Dec 2022 18:01:52 +0900 Message-Id: <20221210090157.793547-5-mailhol.vincent@wanadoo.fr> X-Mailer: git-send-email 2.37.4 In-Reply-To: <20221210090157.793547-1-mailhol.vincent@wanadoo.fr> References: <20221203133159.94414-1-mailhol.vincent@wanadoo.fr> <20221210090157.793547-1-mailhol.vincent@wanadoo.fr> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: linux-usb@vger.kernel.org kvaser_usb sets the driver's priv data to NULL before waiting for the completion of outsdanding urbs. This can results in NULL pointer dereference, c.f. [1] and [2]. Remove the call to usb_set_intfdata(intf, NULL). The core will take care of setting it to NULL after kvaser_usb_disconnect() at [3]. [1] c/27ef17849779 ("usb: add usb_set_intfdata() documentation") Link: https://git.kernel.org/gregkh/usb/c/27ef17849779 [2] thread about usb_set_intfdata() on linux-usb mailing. Link: https://lore.kernel.org/linux-usb/Y4OD70GD4KnoRk0k@rowland.harvard.edu/ [3] function usb_unbind_interface() from drivers/usb/core/driver.c Link: https://elixir.bootlin.com/linux/v6.0/source/drivers/usb/core/driver.c#L497 Fixes: 080f40a6fa28 ("can: kvaser_usb: Add support for Kvaser CAN/USB devices") Signed-off-by: Vincent Mailhol --- @stable team: the function was moved from kvaser_usb.c to kvaser_usb_core.c in: 7259124eac7d1 ("can: kvaser_usb: Split driver into kvaser_usb_core.c and kvaser_usb_leaf.c") --- drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c | 2 -- 1 file changed, 2 deletions(-) diff --git a/drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c b/drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c index 3a2bfaad1406..dad916b3288e 100644 --- a/drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c +++ b/drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c @@ -981,8 +981,6 @@ static void kvaser_usb_disconnect(struct usb_interface *intf) { struct kvaser_usb *dev = usb_get_intfdata(intf); - usb_set_intfdata(intf, NULL); - if (!dev) return; From patchwork Sat Dec 10 09:01:54 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Vincent MAILHOL X-Patchwork-Id: 633223 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 8BBDEC4167B for ; Sat, 10 Dec 2022 09:05:27 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230048AbiLJJFZ (ORCPT ); Sat, 10 Dec 2022 04:05:25 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:45708 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229949AbiLJJDh (ORCPT ); Sat, 10 Dec 2022 04:03:37 -0500 Received: from mail-pj1-x102e.google.com (mail-pj1-x102e.google.com [IPv6:2607:f8b0:4864:20::102e]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id C52371A391; Sat, 10 Dec 2022 01:03:31 -0800 (PST) Received: by mail-pj1-x102e.google.com with SMTP id u5so7193909pjy.5; Sat, 10 Dec 2022 01:03:31 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:sender:from:to:cc:subject:date :message-id:reply-to; bh=Fbmtr+iu05G8hE8+xl0zyODEJYTrkuIzNhZByD6qtnU=; b=UgzLWMXzuwLLSAvD3KHkxw0Bw89627SDEXoKyGTUeeML2rh1RnKO4wDuj3np4KehRh gbavZMR6IMWyNrOyBD3I6w3lEqDVKQCG8GUZGBrpuqvYECsIy+ZYEHwU95f0ezAzP5fv yF6WOlLlP2kIgwoKQBpKVizodDklO8bZ8GDcyAdIUNYygfxi6Zf+ne7vWUbL00IiDHdE 5XalkUklF4SWXQ1dBsARtlGDm6i//q1t0YA9kJ6CBNVfS/6UxR2tB4VIXUfFiadNuAMQ 6A3aPWcixahKkvE5ulLgEXMN89Z7v6dmsKPfg7Nc0xj0bMY7oYa8L6LOsUYf/mqOb0FN Nvyw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:sender:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=Fbmtr+iu05G8hE8+xl0zyODEJYTrkuIzNhZByD6qtnU=; b=3KQvLBLW0Yarpz1XjvIoxdagUgGkpjzde9mpgvYciB+LItaXHRmCIAA4BZrsq5fsq3 OPKB2T/sbiBTksyhXDMwXiWzbHY2VjaXicfryub31IRXOtIctYeP9uPQJnX4HZ71R3yp 3KbQM6nJ7vMWLe6l1T2dURLpJYiyUPXORJNOrLsAH1x1PwgzDwcyCmeGKMRtSiz9BWtH 4yXCskq+F4TPvL3jACM4YOX1Zojuue69Y6NZ1cIzxPqmL6luWwiOh9SHQnA/n7rWUQq/ NoSRo2X392mYK7rV8PyfYr3ibssG49cfdzkV7R0xjctJt3cJ4c9rM4GeA7r06fre0aq4 dXew== X-Gm-Message-State: ANoB5pk60McBjFvt9qzl+TcW9vFk4ExsN4a/5Zct544nhtZ4QeY/F4BX ksWLGLInElZTu9a5aaO+UT8= X-Google-Smtp-Source: AA0mqf51A0TZNJaaVYc00wBlbOrjqA1IBl3NJL6KTcsIV7XAYX+HxOIZ2l4Pt/lnCZ/U0cgPYIauIg== X-Received: by 2002:a17:903:41c5:b0:189:cec6:7ac5 with SMTP id u5-20020a17090341c500b00189cec67ac5mr12370330ple.44.1670663011217; Sat, 10 Dec 2022 01:03:31 -0800 (PST) Received: from localhost.localdomain (124x33x176x97.ap124.ftth.ucom.ne.jp. [124.33.176.97]) by smtp.gmail.com with ESMTPSA id u7-20020a17090282c700b00186a2444a43sm2549481plz.27.2022.12.10.01.03.24 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 10 Dec 2022 01:03:30 -0800 (PST) Sender: Vincent Mailhol From: Vincent Mailhol To: Marc Kleine-Budde , linux-can@vger.kernel.org Cc: Oliver Neukum , Wolfgang Grandegger , "David S . Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Frank Jungclaus , socketcan@esd.eu, Yasushi SHOJI , =?utf-8?q?Stefan_M=C3=A4tje?= , Hangyu Hua , Oliver Hartkopp , Peter Fink , Jeroen Hofstee , =?utf-8?q?Christoph_M=C3=B6hring?= , John Whittington , Vasanth Sadhasivan , Jimmy Assarsson , Anssi Hannula , Pavel Skripkin , Stephane Grosjean , Wolfram Sang , "Gustavo A . R . Silva" , Julia Lawall , Dongliang Mu , Sebastian Haas , Maximilian Schneider , Daniel Berglund , Olivier Sobrie , =?utf-8?b?UmVtaWdpdXN6IEtvxYLFgsSFdGFq?= , Jakob Unterwurzacher , Martin Elshuber , Bernd Krumboeck , netdev@vger.kernel.org, linux-kernel@vger.kernel.org, Alan Stern , linux-usb@vger.kernel.org, Vincent Mailhol Subject: [PATCH v2 6/9] can: ucan: ucan_disconnect(): fix NULL pointer dereference Date: Sat, 10 Dec 2022 18:01:54 +0900 Message-Id: <20221210090157.793547-7-mailhol.vincent@wanadoo.fr> X-Mailer: git-send-email 2.37.4 In-Reply-To: <20221210090157.793547-1-mailhol.vincent@wanadoo.fr> References: <20221203133159.94414-1-mailhol.vincent@wanadoo.fr> <20221210090157.793547-1-mailhol.vincent@wanadoo.fr> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: linux-usb@vger.kernel.org ucan sets the driver's priv data to NULL before waiting for the completion of outsdanding urbs. This can results in NULL pointer dereference, c.f. [1] and [2]. Remove the call to usb_set_intfdata(intf, NULL). The core will take care of setting it to NULL after ucan_disconnect() at [3]. [1] c/27ef17849779 ("usb: add usb_set_intfdata() documentation") Link: https://git.kernel.org/gregkh/usb/c/27ef17849779 [2] thread about usb_set_intfdata() on linux-usb mailing. Link: https://lore.kernel.org/linux-usb/Y4OD70GD4KnoRk0k@rowland.harvard.edu/ [3] function usb_unbind_interface() from drivers/usb/core/driver.c Link: https://elixir.bootlin.com/linux/v6.0/source/drivers/usb/core/driver.c#L497 Fixes: 9f2d3eae88d2 ("can: ucan: add driver for Theobroma Systems UCAN devices") Signed-off-by: Vincent Mailhol --- drivers/net/can/usb/ucan.c | 2 -- 1 file changed, 2 deletions(-) diff --git a/drivers/net/can/usb/ucan.c b/drivers/net/can/usb/ucan.c index ffa38f533c35..429b3519ee7f 100644 --- a/drivers/net/can/usb/ucan.c +++ b/drivers/net/can/usb/ucan.c @@ -1579,8 +1579,6 @@ static void ucan_disconnect(struct usb_interface *intf) { struct ucan_priv *up = usb_get_intfdata(intf); - usb_set_intfdata(intf, NULL); - if (up) { unregister_candev(up->netdev); free_candev(up->netdev); From patchwork Sat Dec 10 09:01:56 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Vincent MAILHOL X-Patchwork-Id: 633222 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id CD3C3C4708D for ; Sat, 10 Dec 2022 09:06:23 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230078AbiLJJGV (ORCPT ); Sat, 10 Dec 2022 04:06:21 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:46486 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229915AbiLJJFM (ORCPT ); Sat, 10 Dec 2022 04:05:12 -0500 Received: from mail-pj1-x1033.google.com (mail-pj1-x1033.google.com [IPv6:2607:f8b0:4864:20::1033]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 65C09275D5; Sat, 10 Dec 2022 01:03:46 -0800 (PST) Received: by mail-pj1-x1033.google.com with SMTP id 3-20020a17090a098300b00219041dcbe9so7382602pjo.3; Sat, 10 Dec 2022 01:03:46 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:sender:from:to:cc:subject:date :message-id:reply-to; bh=+JLuq6z6RC38yxJgv0nky22X6DCSZ/hpLwA+DNaYB3g=; b=pYzKZaA9CAYA1lV0aFDqGItcg2wPbv7kFZNxnILtD51hI2Z0Slg+qdAQ8nV1HCcfSA 3p3xy/O3vBdiRfLdB+vj6Ksz9HnYQ4tndul1j1Kus7zt80bmzNr2C2YLRX/tZvXrfkDt qUaV1cJq+DcbxSf1zI+/q5Joe+oQ87GTDXGlZFhO1vrjILUOHuORDxcE7IAswjElSI7d le6Fl9k5YU3CJ3i6FnIn4RsAlFopeglX3XGEIIIgRNTu5/mqb+gTpi6IRJUwzMzelCed facKMtOZwVa5+ygm2R2ua7ITJc3cKCdpWfxXJjFE0bq10g5KfSv9/5tMS9zsdbeoRnTO 3EGA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:sender:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=+JLuq6z6RC38yxJgv0nky22X6DCSZ/hpLwA+DNaYB3g=; b=Jh5Ic65uP4swDCyt6PC9bIF7UZf2cFCQjEseRPnM7Dh9beoDzT1r3qeC+vzUAgK4/L GLyQFJR1jFB+Rvq31F3rP2PXGyq+K6cTWufqqwUOwS+UT109Zuuh8kKC4kc8tQ+KUzGL oSfMelFoMMkUIlP5di3jqfK8vQ+CNCf31oUFLWzAmYzP9XLA+eS+uLdWe9nc1aC6jXEb S2zyZhQ8eZyaGqblDHkeSr3fIcnkEYdOszQw44/yftxPZrH4YbtfMXDPhM0V0G3tyJs4 ckCrdx7FpjCnARLyifpVq52V720U9Ra4xRbnEt++Eom2qFmdK3J/jh14ItpKYqIjh7je apLQ== X-Gm-Message-State: ANoB5plmAfaVw6oOYflOr4cDVW8RaGcdbtWal+2dtppzUhCTwr7Etjth 3vghoyYwpxGDFAYZkM2vGO4= X-Google-Smtp-Source: AA0mqf5GYgzbWRjQtqXiUGu1YTp8NbJSFZIcWwB5I4kyyqbNyUl5s6xLM9EWIeUdmcdrqCnGmQYpzg== X-Received: by 2002:a17:903:120b:b0:188:eec0:f1e with SMTP id l11-20020a170903120b00b00188eec00f1emr11952017plh.63.1670663025813; Sat, 10 Dec 2022 01:03:45 -0800 (PST) Received: from localhost.localdomain (124x33x176x97.ap124.ftth.ucom.ne.jp. [124.33.176.97]) by smtp.gmail.com with ESMTPSA id u7-20020a17090282c700b00186a2444a43sm2549481plz.27.2022.12.10.01.03.38 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 10 Dec 2022 01:03:45 -0800 (PST) Sender: Vincent Mailhol From: Vincent Mailhol To: Marc Kleine-Budde , linux-can@vger.kernel.org Cc: Oliver Neukum , Wolfgang Grandegger , "David S . Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Frank Jungclaus , socketcan@esd.eu, Yasushi SHOJI , =?utf-8?q?Stefan_M=C3=A4tje?= , Hangyu Hua , Oliver Hartkopp , Peter Fink , Jeroen Hofstee , =?utf-8?q?Christoph_M=C3=B6hring?= , John Whittington , Vasanth Sadhasivan , Jimmy Assarsson , Anssi Hannula , Pavel Skripkin , Stephane Grosjean , Wolfram Sang , "Gustavo A . R . Silva" , Julia Lawall , Dongliang Mu , Sebastian Haas , Maximilian Schneider , Daniel Berglund , Olivier Sobrie , =?utf-8?b?UmVtaWdpdXN6IEtvxYLFgsSFdGFq?= , Jakob Unterwurzacher , Martin Elshuber , Bernd Krumboeck , netdev@vger.kernel.org, linux-kernel@vger.kernel.org, Alan Stern , linux-usb@vger.kernel.org, Vincent Mailhol Subject: [PATCH v2 8/9] can: usb: remove useless check on driver data Date: Sat, 10 Dec 2022 18:01:56 +0900 Message-Id: <20221210090157.793547-9-mailhol.vincent@wanadoo.fr> X-Mailer: git-send-email 2.37.4 In-Reply-To: <20221210090157.793547-1-mailhol.vincent@wanadoo.fr> References: <20221203133159.94414-1-mailhol.vincent@wanadoo.fr> <20221210090157.793547-1-mailhol.vincent@wanadoo.fr> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: linux-usb@vger.kernel.org Many of the can usb drivers checks in their usb_driver::disconnect() whether the driver data is NULL or not. This check only makes sense if the disconnect function can be called more than one time. This is not the case for can usb drivers. Remove all checks toward drivers priv data in disconnect(). Signed-off-by: Vincent Mailhol --- drivers/net/can/usb/ems_usb.c | 14 ++++++-------- drivers/net/can/usb/esd_usb.c | 16 +++++++--------- drivers/net/can/usb/gs_usb.c | 5 ----- drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c | 7 +------ drivers/net/can/usb/ucan.c | 6 ++---- drivers/net/can/usb/usb_8dev.c | 11 ++++------- 6 files changed, 20 insertions(+), 39 deletions(-) diff --git a/drivers/net/can/usb/ems_usb.c b/drivers/net/can/usb/ems_usb.c index c64cb40ac8de..8bd555eb741f 100644 --- a/drivers/net/can/usb/ems_usb.c +++ b/drivers/net/can/usb/ems_usb.c @@ -1062,18 +1062,16 @@ static void ems_usb_disconnect(struct usb_interface *intf) { struct ems_usb *dev = usb_get_intfdata(intf); - if (dev) { - unregister_netdev(dev->netdev); + unregister_netdev(dev->netdev); - unlink_all_urbs(dev); + unlink_all_urbs(dev); - usb_free_urb(dev->intr_urb); + usb_free_urb(dev->intr_urb); - kfree(dev->intr_in_buffer); - kfree(dev->tx_msg_buffer); + kfree(dev->intr_in_buffer); + kfree(dev->tx_msg_buffer); - free_candev(dev->netdev); - } + free_candev(dev->netdev); } /* usb specific object needed to register this driver with the usb subsystem */ diff --git a/drivers/net/can/usb/esd_usb.c b/drivers/net/can/usb/esd_usb.c index f3006c6dc5d6..775ab704a295 100644 --- a/drivers/net/can/usb/esd_usb.c +++ b/drivers/net/can/usb/esd_usb.c @@ -1127,17 +1127,15 @@ static void esd_usb_disconnect(struct usb_interface *intf) device_remove_file(&intf->dev, &dev_attr_hardware); device_remove_file(&intf->dev, &dev_attr_nets); - if (dev) { - for (i = 0; i < dev->net_count; i++) { - if (dev->nets[i]) { - netdev = dev->nets[i]->netdev; - unregister_netdev(netdev); - free_candev(netdev); - } + for (i = 0; i < dev->net_count; i++) { + if (dev->nets[i]) { + netdev = dev->nets[i]->netdev; + unregister_netdev(netdev); + free_candev(netdev); } - unlink_all_urbs(dev); - kfree(dev); } + unlink_all_urbs(dev); + kfree(dev); } /* usb specific object needed to register this driver with the usb subsystem */ diff --git a/drivers/net/can/usb/gs_usb.c b/drivers/net/can/usb/gs_usb.c index 97b1da8fd19f..40190816e313 100644 --- a/drivers/net/can/usb/gs_usb.c +++ b/drivers/net/can/usb/gs_usb.c @@ -1458,11 +1458,6 @@ static void gs_usb_disconnect(struct usb_interface *intf) struct gs_usb *dev = usb_get_intfdata(intf); unsigned int i; - if (!dev) { - dev_err(&intf->dev, "Disconnect (nodata)\n"); - return; - } - for (i = 0; i < GS_MAX_INTF; i++) if (dev->canch[i]) gs_destroy_candev(dev->canch[i]); diff --git a/drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c b/drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c index dad916b3288e..9e83b61db96b 100644 --- a/drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c +++ b/drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c @@ -979,12 +979,7 @@ static int kvaser_usb_probe(struct usb_interface *intf, static void kvaser_usb_disconnect(struct usb_interface *intf) { - struct kvaser_usb *dev = usb_get_intfdata(intf); - - if (!dev) - return; - - kvaser_usb_remove_interfaces(dev); + kvaser_usb_remove_interfaces(usb_get_intfdata(intf)); } static struct usb_driver kvaser_usb_driver = { diff --git a/drivers/net/can/usb/ucan.c b/drivers/net/can/usb/ucan.c index 429b3519ee7f..205941122f9e 100644 --- a/drivers/net/can/usb/ucan.c +++ b/drivers/net/can/usb/ucan.c @@ -1579,10 +1579,8 @@ static void ucan_disconnect(struct usb_interface *intf) { struct ucan_priv *up = usb_get_intfdata(intf); - if (up) { - unregister_candev(up->netdev); - free_candev(up->netdev); - } + unregister_candev(up->netdev); + free_candev(up->netdev); } static struct usb_device_id ucan_table[] = { diff --git a/drivers/net/can/usb/usb_8dev.c b/drivers/net/can/usb/usb_8dev.c index ae618809fc05..4d80049ebff7 100644 --- a/drivers/net/can/usb/usb_8dev.c +++ b/drivers/net/can/usb/usb_8dev.c @@ -990,14 +990,11 @@ static void usb_8dev_disconnect(struct usb_interface *intf) { struct usb_8dev_priv *priv = usb_get_intfdata(intf); - if (priv) { - netdev_info(priv->netdev, "device disconnected\n"); - - unregister_netdev(priv->netdev); - unlink_all_urbs(priv); - free_candev(priv->netdev); - } + netdev_info(priv->netdev, "device disconnected\n"); + unregister_netdev(priv->netdev); + unlink_all_urbs(priv); + free_candev(priv->netdev); } static struct usb_driver usb_8dev_driver = {