| Message ID | 7d0481da-5852-4566-9adb-3a8bb74cb159@stanley.mountain (mailing list archive) |
|---|---|
| State | New |
| Headers | show |
| Series | USB: serial: Fix use after free in debug printk | expand |
On Thu, Oct 31, 2024 at 09:59:10AM +0300, Dan Carpenter wrote: > The dev_dbg() call dereferences "urb" but it was already freed on the > previous line. Move the debug output earlier in the function. Thanks for catching this, but please use a temporary variable for the struct device pointer instead of changing the flow. Also make sure to include the driver name in the patch summary prefix (i.e. "USB: serial: io_edgeport: ..."): > Fixes: 984f68683298 ("USB: serial: io_edgeport.c: remove dbg() usage") > Cc: stable@vger.kernel.org > Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org> Johan
On Thu, Oct 31, 2024 at 10:07:42AM +0100, Johan Hovold wrote: > On Thu, Oct 31, 2024 at 09:59:10AM +0300, Dan Carpenter wrote: > > The dev_dbg() call dereferences "urb" but it was already freed on the > > previous line. Move the debug output earlier in the function. > > Thanks for catching this, but please use a temporary variable for the > struct device pointer instead of changing the flow. > Why? The output is the same either way and this way is cleaner code. > Also make sure to include the driver name in the patch summary prefix > (i.e. "USB: serial: io_edgeport: ..."): Sure. regards, dan carpenter
On Thu, Oct 31, 2024 at 12:35:31PM +0300, Dan Carpenter wrote: > On Thu, Oct 31, 2024 at 10:07:42AM +0100, Johan Hovold wrote: > > On Thu, Oct 31, 2024 at 09:59:10AM +0300, Dan Carpenter wrote: > > > The dev_dbg() call dereferences "urb" but it was already freed on the > > > previous line. Move the debug output earlier in the function. > > > > Thanks for catching this, but please use a temporary variable for the > > struct device pointer instead of changing the flow. > > > > Why? The output is the same either way and this way is cleaner code. > Nah, you're right. A temporary variable is nicer. It avoids having two if statements. regards, dan carpenter
On Thu, Oct 31, 2024 at 12:39:10PM +0300, Dan Carpenter wrote: > On Thu, Oct 31, 2024 at 12:35:31PM +0300, Dan Carpenter wrote: > > On Thu, Oct 31, 2024 at 10:07:42AM +0100, Johan Hovold wrote: > > > On Thu, Oct 31, 2024 at 09:59:10AM +0300, Dan Carpenter wrote: > > > > The dev_dbg() call dereferences "urb" but it was already freed on the > > > > previous line. Move the debug output earlier in the function. > > > > > > Thanks for catching this, but please use a temporary variable for the > > > struct device pointer instead of changing the flow. > > > > Why? The output is the same either way and this way is cleaner code. > > Nah, you're right. A temporary variable is nicer. It avoids having two if > statements. Yeah, and the debug printk belongs with the return. v2 now applied, thanks. Johan
diff --git a/drivers/usb/serial/io_edgeport.c b/drivers/usb/serial/io_edgeport.c index c7d6b5e3f898..b8f1bd41fb24 100644 --- a/drivers/usb/serial/io_edgeport.c +++ b/drivers/usb/serial/io_edgeport.c @@ -775,7 +775,10 @@ static void edge_bulk_out_cmd_callback(struct urb *urb) atomic_dec(&CmdUrbs); dev_dbg(&urb->dev->dev, "%s - FREE URB %p (outstanding %d)\n", __func__, urb, atomic_read(&CmdUrbs)); - + if (status) + dev_dbg(&urb->dev->dev, + "%s - nonzero write bulk status received: %d\n", + __func__, status); /* clean up the transfer buffer */ kfree(urb->transfer_buffer); @@ -783,12 +786,8 @@ static void edge_bulk_out_cmd_callback(struct urb *urb) /* Free the command urb */ usb_free_urb(urb); - if (status) { - dev_dbg(&urb->dev->dev, - "%s - nonzero write bulk status received: %d\n", - __func__, status); + if (status) return; - } /* tell the tty driver that something has changed */ if (edge_port->open)
The dev_dbg() call dereferences "urb" but it was already freed on the previous line. Move the debug output earlier in the function. Fixes: 984f68683298 ("USB: serial: io_edgeport.c: remove dbg() usage") Cc: stable@vger.kernel.org Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org> --- drivers/usb/serial/io_edgeport.c | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-)