From patchwork Sat Dec 3 13:31:51 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Vincent Mailhol X-Patchwork-Id: 13063538 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 56A04C4708D for ; Sat, 3 Dec 2022 13:32:22 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229740AbiLCNcU (ORCPT ); Sat, 3 Dec 2022 08:32:20 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:53488 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229555AbiLCNcT (ORCPT ); Sat, 3 Dec 2022 08:32:19 -0500 Received: from mail-pl1-x633.google.com (mail-pl1-x633.google.com [IPv6:2607:f8b0:4864:20::633]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 4D5081CB31; Sat, 3 Dec 2022 05:32:18 -0800 (PST) Received: by mail-pl1-x633.google.com with SMTP id a9so7037433pld.7; Sat, 03 Dec 2022 05:32:18 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:sender:from:to:cc:subject:date:message-id:reply-to; bh=Ge/hvb27wH9tqZKTvQJ35IDsoTdlfsfW2RzAv9+gF3w=; b=k1d/Uab7IlDLX6e5E27qe0CBQhCi8ZjEvPIIa1x/Usq+VKJF6+mnGK0TX8YOHsljsh qjh7BmIzwix8tJ2FT4KpULD2oM7vwMdmRyNK30rZo1j97USnIcNAw621wo580gQswMSQ YwkcC+3xRtYXlyf66EfqIwkimsRZMJXDjP5AEBz8mrxJ/prAO2+NPiD3goVnjiK2i44/ 1gajD9iTICYw+9dBUFlOyiPXoEcrhKBAIMJcI5b9ggoYM2Xmr4WzkDcV5zHeG/2BEwME 5Y8GHBAZLGfXs11By/wtaHn6aTynVdko9MTpNo+7jtEpw717d63USI6tR9gmIpTu/07u 4Ozg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:sender:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=Ge/hvb27wH9tqZKTvQJ35IDsoTdlfsfW2RzAv9+gF3w=; b=ZbHMGi4454YtL26hGmcT+iFZcPE1X65iVF4JLK4hBA8eCFZ7CvRx4oDl6S85tgvx2t dLCw1+PnDGrw/R2wSDOohEfOpwWkghLzwMO/d5H8hRfiiZcqLvVKbFKwrN2a9hCL1JiU XP8jDeZxrk1NiH3mL0esYzfK12y1zBgq1mP/wm9ccfe9E/w+Ns0avlRBqvoIquMObO+l WalPPvdZ16+Wy7S7brkfy0i5WaXP4+ieoU9p3BiXJwI3b1IXX2riK5kcb2zUEjAKOj7S 4joliveYhsZc6kv9KrFVozbym7PdPwoQf56Z7y0Eu7934OkjOyZOSH2svfNFtYFSBUXC B+aA== X-Gm-Message-State: ANoB5pnItWg99W5o36LZiYOxe9yKH08FV/qrx3smFFK/nrxh1JiOOW48 hkkimogVP+9bpyKG+mFuWqg= X-Google-Smtp-Source: AA0mqf5B214dZKTD3qNQ4z0ukitrTNIFHKRW3JKAkwCYTOVPzjoiTNoTrVfvT46AGxqY8zVloxL69A== X-Received: by 2002:a17:902:7885:b0:189:1366:fba7 with SMTP id q5-20020a170902788500b001891366fba7mr58575707pll.45.1670074337649; Sat, 03 Dec 2022 05:32:17 -0800 (PST) Received: from localhost.localdomain (124x33x176x97.ap124.ftth.ucom.ne.jp. [124.33.176.97]) by smtp.gmail.com with ESMTPSA id q12-20020a170902dacc00b00185402cfedesm7414472plx.246.2022.12.03.05.32.10 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 03 Dec 2022 05:32:17 -0800 (PST) Sender: Vincent Mailhol From: Vincent Mailhol To: Marc Kleine-Budde , linux-can@vger.kernel.org Cc: Wolfgang Grandegger , "David S . Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Frank Jungclaus , socketcan@esd.eu, Yasushi SHOJI , =?utf-8?q?Stefan_M=C3=A4tje?= , Hangyu Hua , Oliver Hartkopp , Peter Fink , Jeroen Hofstee , =?utf-8?q?Christoph_M=C3=B6hring?= , John Whittington , Vasanth Sadhasivan , Jimmy Assarsson , Anssi Hannula , Pavel Skripkin , Stephane Grosjean , Wolfram Sang , "Gustavo A . R . Silva" , Julia Lawall , Dongliang Mu , Sebastian Haas , Maximilian Schneider , Daniel Berglund , Olivier Sobrie , =?utf-8?b?UmVtaWdpdXN6IEtvxYLFgsSFdGFq?= , Jakob Unterwurzacher , Martin Elshuber , Philipp Tomsich , Bernd Krumboeck , netdev@vger.kernel.org, linux-kernel@vger.kernel.org, Alan Stern , linux-usb@vger.kernel.org, Vincent Mailhol Subject: [PATCH 0/8] can: usb: remove all usb_set_intfdata(intf, NULL) in drivers' disconnect() Date: Sat, 3 Dec 2022 22:31:51 +0900 Message-Id: <20221203133159.94414-1-mailhol.vincent@wanadoo.fr> X-Mailer: git-send-email 2.37.4 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: linux-usb@vger.kernel.org The core sets the usb_interface to NULL in [1]. Also setting it to NULL in usb_driver::disconnects() is at best useless, at worse risky. Indeed, if a driver set the usb interface to NULL before all actions relying on the interface-data pointer complete, there is a risk of NULL pointer dereference. Typically, this is the case if there are outstanding urbs which have not yet completed when entering disconnect(). If all actions are already completed, doing usb_set_intfdata(intf, NULL) is useless because the core does it at [1]. The first seven patches fix all drivers which set their usb_interface to NULL while outstanding URB might still exists. There is one patch per driver in order to add the relevant "Fixes:" tag to each of them. The last patch removes in bulk the remaining benign calls to usb_set_intfdata(intf, NULL) in etas_es58x and peak_usb. N.B. some other usb drivers outside of the can tree also have the same issue, but this is out of scope of this. [1] function usb_unbind_interface() from drivers/usb/core/driver.c Link: https://elixir.bootlin.com/linux/v6.0/source/drivers/usb/core/driver.c#L497 Vincent Mailhol (8): can: ems_usb: ems_usb_disconnect(): fix NULL pointer dereference can: esd_usb: esd_usb_disconnect(): fix NULL pointer dereference can: gs_usb: gs_usb_disconnect(): fix NULL pointer dereference can: kvaser_usb: kvaser_usb_disconnect(): fix NULL pointer dereference can: mcba_usb: mcba_usb_disconnect(): fix NULL pointer dereference can: ucan: ucan_disconnect(): fix NULL pointer dereference can: usb_8dev: usb_8dev_disconnect(): fix NULL pointer dereference can: etas_es58x and peak_usb: remove useless call to usb_set_intfdata() drivers/net/can/usb/ems_usb.c | 2 -- drivers/net/can/usb/esd_usb.c | 2 -- drivers/net/can/usb/etas_es58x/es58x_core.c | 1 - drivers/net/can/usb/gs_usb.c | 2 -- drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c | 2 -- drivers/net/can/usb/mcba_usb.c | 2 -- drivers/net/can/usb/peak_usb/pcan_usb_core.c | 2 -- drivers/net/can/usb/ucan.c | 2 -- drivers/net/can/usb/usb_8dev.c | 2 -- 9 files changed, 17 deletions(-)