Re: [Bug 220052] The usb/cdc-acm driver uses memory after it is freed

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On 30.04.25 14:56, bugzilla-daemon@xxxxxxxxxx wrote:
Exchanging the 2 lines as indicated in the patch solves the problem completely
and the kernel panic is not seen anymore. This is proved by 7000 'virtual'
disconnects.


Yes, it solves your particular problem.

Now, with your patch, you first call
acm_submit_read_urbs() -> acm_submit_read_urb():

res = usb_submit_urb(acm->read_urbs[index], mem_flags);

And then you do

+                       for (i = 0; i < acm->rx_buflimit; i++)
+                               usb_kill_urb(acm->read_urbs[i]);

In other words, you undo what you just did.

Your diagnosis of the issue may be good, but the fix is _not_.
The purpose of acm_softint() is to

1. kill outstanding IO
2. error handling with usb_clear_halt()
3. restart the outstanding IO

You cannot reverse steps 1 and 3 and expect that to work.
The issue must be one of refcounting.

	Sorry
		Oliver







[Index of Archives]     [Linux Media]     [Linux Input]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]     [Old Linux USB Devel Archive]

  Powered by Linux