[Bug 220052] The usb/cdc-acm driver uses memory after it is freed

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



https://bugzilla.kernel.org/show_bug.cgi?id=220052

--- Comment #4 from oneukum@xxxxxxxx ---
On 30.04.25 14:56, bugzilla-daemon@xxxxxxxxxx wrote:

> Exchanging the 2 lines as indicated in the patch solves the problem
> completely
> and the kernel panic is not seen anymore. This is proved by 7000 'virtual'
> disconnects.
> 

Yes, it solves your particular problem.

Now, with your patch, you first call
acm_submit_read_urbs() -> acm_submit_read_urb():

res = usb_submit_urb(acm->read_urbs[index], mem_flags);

And then you do

+                       for (i = 0; i < acm->rx_buflimit; i++)
+                               usb_kill_urb(acm->read_urbs[i]);

In other words, you undo what you just did.

Your diagnosis of the issue may be good, but the fix is _not_.
The purpose of acm_softint() is to

1. kill outstanding IO
2. error handling with usb_clear_halt()
3. restart the outstanding IO

You cannot reverse steps 1 and 3 and expect that to work.
The issue must be one of refcounting.

        Sorry
                Oliver

-- 
You may reply to this email to add a comment.

You are receiving this mail because:
You are watching the assignee of the bug.




[Index of Archives]     [Linux Media]     [Linux Input]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]     [Old Linux USB Devel Archive]

  Powered by Linux