From patchwork Sat Dec 3 13:31:52 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Vincent Mailhol X-Patchwork-Id: 13063539 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 882C0C4708D for ; Sat, 3 Dec 2022 13:32:31 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229757AbiLCNc3 (ORCPT ); Sat, 3 Dec 2022 08:32:29 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:53532 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229755AbiLCNc0 (ORCPT ); Sat, 3 Dec 2022 08:32:26 -0500 Received: from mail-pj1-x102b.google.com (mail-pj1-x102b.google.com [IPv6:2607:f8b0:4864:20::102b]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 424AE1DDE1; Sat, 3 Dec 2022 05:32:25 -0800 (PST) Received: by mail-pj1-x102b.google.com with SMTP id k5so7329790pjo.5; Sat, 03 Dec 2022 05:32:25 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:sender:from:to:cc:subject:date :message-id:reply-to; bh=LDbQ/ixPZp4MuAgA81AzBaLcxOr0XSMHsSft2Avw78E=; b=DAcUroikxVvLn80Gwk/9VcQcseLDD0vWDs8loVwkpuS0FYWw+9DuTDUxxW2w4BI0T0 +HjWbfZY/qdF5l+mLHbYnQmeOkCzi5lTn31NL4/3GaMnOo6dsB3Wq8VG/9hx4WGi8p2x ihSoCi2LAMU6EosEy9PbuUkKhMZ1Y7hFfpTatgNifXzAPVkLgq/n2Ey5CeCX30iirCy4 aN5DFYm6+Fu+AcEU0sZplzVIknKSAbjTZ4El+SQQUj6Z+6C4aIo3pVoPlc7lIsmy6bwH ZjYDcNV0jQO9mK9R9TdhpSiRFF+Ooh+Y3p1uu3FDEvNQZV4vIt1KK5cuLLSXMuK+R6NZ uhjA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:sender:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=LDbQ/ixPZp4MuAgA81AzBaLcxOr0XSMHsSft2Avw78E=; b=XM8n9J+WHGDBRTEyaDTdg/tOXKPkEyhP0PXxa8Djmp/8KdbYMEiPq4qRjcd0hJedqr 5FBNqJCJeOgOXX34RjNX18aAJ+fRJ0rWl9EY8vNlznJ/LTdcouSeunaTQFanXUxc6htF iglyDCRmQxtHglzGUrCveC4S9hjXLntlh3LJHnPXJvaw3EvhCTpADzd+MWfATAONtMgG JnL/FDD0Pk56Ink/zc4eXZTw/sTAAu/NLuNrXCgnCZkRRDEDj74SYjpC6AfYZmKEVnYh AHerIwOziLBe+9G/ZEYKBz5dGCXrb62M1AGTmsbeHtlaJ8pR3KF0HQui2jYoJgDXMgXx I3vQ== X-Gm-Message-State: ANoB5pmlbKT1Y1c/muwDwTjwnCqPKzg0islgFs3pT0s7BMeLo0B2/Ln9 MAH52/yeAR2jmrO3AU5LT5M= X-Google-Smtp-Source: AA0mqf5Nc0j1Mx5FIWuxqTHyDKOot9BG829w40CZ4gxqboITEFsJ/QsGCy30VzXpYVRKnhUU4UV+UQ== X-Received: by 2002:a17:902:7b84:b0:189:6623:4c47 with SMTP id w4-20020a1709027b8400b0018966234c47mr6131538pll.170.1670074344657; Sat, 03 Dec 2022 05:32:24 -0800 (PST) Received: from localhost.localdomain (124x33x176x97.ap124.ftth.ucom.ne.jp. [124.33.176.97]) by smtp.gmail.com with ESMTPSA id q12-20020a170902dacc00b00185402cfedesm7414472plx.246.2022.12.03.05.32.17 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 03 Dec 2022 05:32:24 -0800 (PST) Sender: Vincent Mailhol From: Vincent Mailhol To: Marc Kleine-Budde , linux-can@vger.kernel.org Cc: Wolfgang Grandegger , "David S . Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Frank Jungclaus , socketcan@esd.eu, Yasushi SHOJI , =?utf-8?q?Stefan_M=C3=A4tje?= , Hangyu Hua , Oliver Hartkopp , Peter Fink , Jeroen Hofstee , =?utf-8?q?Christoph_M=C3=B6hring?= , John Whittington , Vasanth Sadhasivan , Jimmy Assarsson , Anssi Hannula , Pavel Skripkin , Stephane Grosjean , Wolfram Sang , "Gustavo A . R . Silva" , Julia Lawall , Dongliang Mu , Sebastian Haas , Maximilian Schneider , Daniel Berglund , Olivier Sobrie , =?utf-8?b?UmVtaWdpdXN6IEtvxYLFgsSFdGFq?= , Jakob Unterwurzacher , Martin Elshuber , Philipp Tomsich , Bernd Krumboeck , netdev@vger.kernel.org, linux-kernel@vger.kernel.org, Alan Stern , linux-usb@vger.kernel.org, Vincent Mailhol Subject: [PATCH 1/8] can: ems_usb: ems_usb_disconnect(): fix NULL pointer dereference Date: Sat, 3 Dec 2022 22:31:52 +0900 Message-Id: <20221203133159.94414-2-mailhol.vincent@wanadoo.fr> X-Mailer: git-send-email 2.37.4 In-Reply-To: <20221203133159.94414-1-mailhol.vincent@wanadoo.fr> References: <20221203133159.94414-1-mailhol.vincent@wanadoo.fr> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: linux-usb@vger.kernel.org ems_usb sets the usb_interface to NULL before waiting for the completion of outstanding urbs. This can result in NULL pointer dereference, c.f. [1] and [2]. Remove the call to usb_set_intfdata(intf, NULL). The core will take care of setting it to NULL after ems_usb_disconnect() at [3]. [1] commit 27ef17849779 ("usb: add usb_set_intfdata() documentation") Link: https://git.kernel.org/gregkh/usb/c/27ef17849779 [2] thread about usb_set_intfdata() on linux-usb mailing. Link: https://lore.kernel.org/linux-usb/Y4OD70GD4KnoRk0k@rowland.harvard.edu/ [3] function usb_unbind_interface() from drivers/usb/core/driver.c Link: https://elixir.bootlin.com/linux/v6.0/source/drivers/usb/core/driver.c#L497 Fixes: 702171adeed3 ("ems_usb: Added support for EMS CPC-USB/ARM7 CAN/USB interface") Signed-off-by: Vincent Mailhol --- drivers/net/can/usb/ems_usb.c | 2 -- 1 file changed, 2 deletions(-) diff --git a/drivers/net/can/usb/ems_usb.c b/drivers/net/can/usb/ems_usb.c index 050c0b49938a..c64cb40ac8de 100644 --- a/drivers/net/can/usb/ems_usb.c +++ b/drivers/net/can/usb/ems_usb.c @@ -1062,8 +1062,6 @@ static void ems_usb_disconnect(struct usb_interface *intf) { struct ems_usb *dev = usb_get_intfdata(intf); - usb_set_intfdata(intf, NULL); - if (dev) { unregister_netdev(dev->netdev); From patchwork Sat Dec 3 13:31:53 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Vincent Mailhol X-Patchwork-Id: 13063540 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id A3089C47088 for ; Sat, 3 Dec 2022 13:32:44 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229805AbiLCNcn (ORCPT ); Sat, 3 Dec 2022 08:32:43 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:54286 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229777AbiLCNcj (ORCPT ); Sat, 3 Dec 2022 08:32:39 -0500 Received: from mail-pf1-x42a.google.com (mail-pf1-x42a.google.com [IPv6:2607:f8b0:4864:20::42a]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 473FF194; Sat, 3 Dec 2022 05:32:32 -0800 (PST) Received: by mail-pf1-x42a.google.com with SMTP id 124so7405212pfy.0; Sat, 03 Dec 2022 05:32:32 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:sender:from:to:cc:subject:date :message-id:reply-to; bh=7pjs45ntgNRASTRoyX7CM51YIxmh03yjLfxCM0EIb/0=; b=EnT1MsiDYta+wJlbS88GSMxblBGgTicp99DzVINXPA5Fp9QTb0bHsvWQKwe5CDhQqd R7TYERtUDrk0ODhRWv1WYAVnJgbOQXV+OdbaA4E3lsPFlM0h2LqVZT6KkSFfjR6zFlRp ahlPVSpN1FfKLTtTXMaxNfQhLCR6mpG6WW1pSvZEGvrrNQlYk+7bayx9CzTAy+40i8oA KvbxjQtKU9tiGAIJX0/7qqTfX7SMBN398G9ZMrR6Hy2oQP00C5rtuyPrzMNcZ+Ni/tc7 P0zkvUPiVIJz+64PhAgxzmZ1xYCMiL7GuFO8n/HvRYZN4emxwjXySzMCkFF+CXlfY0bU 2pbw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:sender:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=7pjs45ntgNRASTRoyX7CM51YIxmh03yjLfxCM0EIb/0=; b=t2tdo1l6s/3Otw92vKVo87xm/cMUHTzVPJK+aRrXlcsUu3h53KZhDoznZuN3yzzV3Z yBsBq45Vx9y9jnO7EKXeFQBPTqVkmfXWHh5gMSIR6FacbKAyfuXGJrb4Irt4N7jLuD4k lvv8ra5AW5xACgw8h7Z98DVIDoUo/iDJhKmipGhAJYmwggV2ax+2SpQjWOgcVLr5UyeD fol4l2uVQrQcTowUTSrOsXiJ29XDVSIl3+riGGqEyxLBGG9pZm2yuP7wkdGHSg+vHSJz i+h8SxapbJmC8JsgbphOoY93CguRSqp75LUTABgviK5wuqnSke/T70o6m9NXvn2kitmd qolg== X-Gm-Message-State: ANoB5pk/sawkQyvoytumMklxLCMvhquM8QtkR7z8+exZ9edhqL2GJF0L HYqwThSwQuPjob5SZ+5AyPo= X-Google-Smtp-Source: AA0mqf4GkQUNg2GaE5p5tEfPeqZfPvmhzgJDNXwdrYhpro3y4sDVD1ZxeDRJKmpwOKCIRfU8UL2kAw== X-Received: by 2002:a05:6a02:118:b0:477:8106:b518 with SMTP id bg24-20020a056a02011800b004778106b518mr52640160pgb.106.1670074351718; Sat, 03 Dec 2022 05:32:31 -0800 (PST) Received: from localhost.localdomain (124x33x176x97.ap124.ftth.ucom.ne.jp. [124.33.176.97]) by smtp.gmail.com with ESMTPSA id q12-20020a170902dacc00b00185402cfedesm7414472plx.246.2022.12.03.05.32.24 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 03 Dec 2022 05:32:31 -0800 (PST) Sender: Vincent Mailhol From: Vincent Mailhol To: Marc Kleine-Budde , linux-can@vger.kernel.org Cc: Wolfgang Grandegger , "David S . Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Frank Jungclaus , socketcan@esd.eu, Yasushi SHOJI , =?utf-8?q?Stefan_M=C3=A4tje?= , Hangyu Hua , Oliver Hartkopp , Peter Fink , Jeroen Hofstee , =?utf-8?q?Christoph_M=C3=B6hring?= , John Whittington , Vasanth Sadhasivan , Jimmy Assarsson , Anssi Hannula , Pavel Skripkin , Stephane Grosjean , Wolfram Sang , "Gustavo A . R . Silva" , Julia Lawall , Dongliang Mu , Sebastian Haas , Maximilian Schneider , Daniel Berglund , Olivier Sobrie , =?utf-8?b?UmVtaWdpdXN6IEtvxYLFgsSFdGFq?= , Jakob Unterwurzacher , Martin Elshuber , Philipp Tomsich , Bernd Krumboeck , netdev@vger.kernel.org, linux-kernel@vger.kernel.org, Alan Stern , linux-usb@vger.kernel.org, Vincent Mailhol Subject: [PATCH 2/8] can: esd_usb: esd_usb_disconnect(): fix NULL pointer dereference Date: Sat, 3 Dec 2022 22:31:53 +0900 Message-Id: <20221203133159.94414-3-mailhol.vincent@wanadoo.fr> X-Mailer: git-send-email 2.37.4 In-Reply-To: <20221203133159.94414-1-mailhol.vincent@wanadoo.fr> References: <20221203133159.94414-1-mailhol.vincent@wanadoo.fr> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: linux-usb@vger.kernel.org esd_usb sets the usb_interface to NULL before waiting for the completion of outstanding urbs. This can result in NULL pointer dereference, c.f. [1] and [2]. Remove the call to usb_set_intfdata(intf, NULL). The core will take care of setting it to NULL after esd_usb_disconnect() at [3]. [1] commit 27ef17849779 ("usb: add usb_set_intfdata() documentation") Link: https://git.kernel.org/gregkh/usb/c/27ef17849779 [2] thread about usb_set_intfdata() on linux-usb mailing. Link: https://lore.kernel.org/linux-usb/Y4OD70GD4KnoRk0k@rowland.harvard.edu/ [3] function usb_unbind_interface() from drivers/usb/core/driver.c Link: https://elixir.bootlin.com/linux/v6.0/source/drivers/usb/core/driver.c#L497 Fixes: 96d8e90382dc ("can: Add driver for esd CAN-USB/2 device") Signed-off-by: Vincent Mailhol --- @stable team: the file was renamed from esd_usb2.c to esd_usb.c in [4]. [4] 5e910bdedc84 ("can/esd_usb2: Rename esd_usb2.c to esd_usb.c") --- drivers/net/can/usb/esd_usb.c | 2 -- 1 file changed, 2 deletions(-) diff --git a/drivers/net/can/usb/esd_usb.c b/drivers/net/can/usb/esd_usb.c index 81b88e9e5bdc..f3006c6dc5d6 100644 --- a/drivers/net/can/usb/esd_usb.c +++ b/drivers/net/can/usb/esd_usb.c @@ -1127,8 +1127,6 @@ static void esd_usb_disconnect(struct usb_interface *intf) device_remove_file(&intf->dev, &dev_attr_hardware); device_remove_file(&intf->dev, &dev_attr_nets); - usb_set_intfdata(intf, NULL); - if (dev) { for (i = 0; i < dev->net_count; i++) { if (dev->nets[i]) { From patchwork Sat Dec 3 13:31:54 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Vincent Mailhol X-Patchwork-Id: 13063541 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3E0EAC47088 for ; Sat, 3 Dec 2022 13:33:10 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229883AbiLCNdI (ORCPT ); Sat, 3 Dec 2022 08:33:08 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:54270 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229786AbiLCNcv (ORCPT ); Sat, 3 Dec 2022 08:32:51 -0500 Received: from mail-pg1-x531.google.com (mail-pg1-x531.google.com [IPv6:2607:f8b0:4864:20::531]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 6E5F360F0; Sat, 3 Dec 2022 05:32:39 -0800 (PST) Received: by mail-pg1-x531.google.com with SMTP id f9so6619432pgf.7; Sat, 03 Dec 2022 05:32:39 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:sender:from:to:cc:subject:date :message-id:reply-to; bh=0NN1lPw0dT0r0dxpD5i+4n4JI5HSJYWUCgSgnFm00Ec=; b=ZfPzGX3AXqYfFvV73ykrZYYM8mbxAMDbiDekjrzIc4KU+ynXH+cVvEvFvyn7/xmZp/ Jlx10WWXTpfUCTeisyAhpcRYWAzE3uYPWOp1ojHYe39e55k37rF2E+nG5ED82moCuxV9 ub16LINdqz1+JNuTxuOLHhx1M1dsTdh9+J6tNGAmC7lZI1osmsMx4iRB02xnMztlwsD/ Y3G1m2YDOFtdOjKqXgVx56NbLshBBs1M77nB6A4f+3QIW2rVQGwnOVDInP2yhVCZ4s/D Cs6PRWsXXzuL4G7GMFuX0OxQGlCQhvXlk4ITlG9G9ryW4Y3stbV+0F/ZhKPJ3MDK7SRg kB6w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:sender:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=0NN1lPw0dT0r0dxpD5i+4n4JI5HSJYWUCgSgnFm00Ec=; b=BjFalEmNH9XxMWGlgUNfIfbx0HWWxv9l99zhy2MOxDY+0OBxawip8yHmAhlSKq0kzg voX3MBSnw7nkguWpWsTIkftOIVN3C+MGeyanXuq3up++apYMX1jBBkuod8v4BSLEB2ko O8nHDAGLxdD0dw6G9hTOZPGI2WGKjBqCG9aDBkxWG4Vpg43OlUJinLZ7F339uqayGakt 4hbCx+ed/YdDk3H63g65Zi8WnTW/5Q4bAMrGVUGfIvSS3/VnIDDpOJQd9LOipSTyOPC4 /6qghEPL44uSJvIldtjh3JY5t80cUl1zzCQ3cEqz2EzkedLfUKa+fIr23tjILVCEF3o+ VWCQ== X-Gm-Message-State: ANoB5pmpX45upeTTGLbg6+CPt6+VZIgNGTwb3sR/PUmbsUs5IyOvZTaj HMb5JGajFFV9lohtgM0PH1E= X-Google-Smtp-Source: AA0mqf7qlKU9WPRgbC7P2r8+RQaPTX5TAimrYHz2O6sRXQ0T3jvnmcB6Vffda7JOwBIiB3myqxjB4g== X-Received: by 2002:a63:ea15:0:b0:457:7285:fd2d with SMTP id c21-20020a63ea15000000b004577285fd2dmr49887486pgi.580.1670074358721; Sat, 03 Dec 2022 05:32:38 -0800 (PST) Received: from localhost.localdomain (124x33x176x97.ap124.ftth.ucom.ne.jp. [124.33.176.97]) by smtp.gmail.com with ESMTPSA id q12-20020a170902dacc00b00185402cfedesm7414472plx.246.2022.12.03.05.32.31 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 03 Dec 2022 05:32:38 -0800 (PST) Sender: Vincent Mailhol From: Vincent Mailhol To: Marc Kleine-Budde , linux-can@vger.kernel.org Cc: Wolfgang Grandegger , "David S . Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Frank Jungclaus , socketcan@esd.eu, Yasushi SHOJI , =?utf-8?q?Stefan_M=C3=A4tje?= , Hangyu Hua , Oliver Hartkopp , Peter Fink , Jeroen Hofstee , =?utf-8?q?Christoph_M=C3=B6hring?= , John Whittington , Vasanth Sadhasivan , Jimmy Assarsson , Anssi Hannula , Pavel Skripkin , Stephane Grosjean , Wolfram Sang , "Gustavo A . R . Silva" , Julia Lawall , Dongliang Mu , Sebastian Haas , Maximilian Schneider , Daniel Berglund , Olivier Sobrie , =?utf-8?b?UmVtaWdpdXN6IEtvxYLFgsSFdGFq?= , Jakob Unterwurzacher , Martin Elshuber , Philipp Tomsich , Bernd Krumboeck , netdev@vger.kernel.org, linux-kernel@vger.kernel.org, Alan Stern , linux-usb@vger.kernel.org, Vincent Mailhol Subject: [PATCH 3/8] can: gs_usb: gs_usb_disconnect(): fix NULL pointer dereference Date: Sat, 3 Dec 2022 22:31:54 +0900 Message-Id: <20221203133159.94414-4-mailhol.vincent@wanadoo.fr> X-Mailer: git-send-email 2.37.4 In-Reply-To: <20221203133159.94414-1-mailhol.vincent@wanadoo.fr> References: <20221203133159.94414-1-mailhol.vincent@wanadoo.fr> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: linux-usb@vger.kernel.org gs_usb sets the usb_interface to NULL before waiting for the completion of outstanding urbs. This can result in NULL pointer dereference, c.f. [1] and [2]. Remove the call to usb_set_intfdata(intf, NULL). The core will take care of setting it to NULL after gs_usb_disconnect() at [3]. [1] commit 27ef17849779 ("usb: add usb_set_intfdata() documentation") Link: https://git.kernel.org/gregkh/usb/c/27ef17849779 [2] thread about usb_set_intfdata() on linux-usb mailing. Link: https://lore.kernel.org/linux-usb/Y4OD70GD4KnoRk0k@rowland.harvard.edu/ [3] function usb_unbind_interface() from drivers/usb/core/driver.c Link: https://elixir.bootlin.com/linux/v6.0/source/drivers/usb/core/driver.c#L497 Fixes: d08e973a77d1 ("can: gs_usb: Added support for the GS_USB CAN devices") Signed-off-by: Vincent Mailhol --- drivers/net/can/usb/gs_usb.c | 2 -- 1 file changed, 2 deletions(-) diff --git a/drivers/net/can/usb/gs_usb.c b/drivers/net/can/usb/gs_usb.c index 838744d2ce34..97b1da8fd19f 100644 --- a/drivers/net/can/usb/gs_usb.c +++ b/drivers/net/can/usb/gs_usb.c @@ -1458,8 +1458,6 @@ static void gs_usb_disconnect(struct usb_interface *intf) struct gs_usb *dev = usb_get_intfdata(intf); unsigned int i; - usb_set_intfdata(intf, NULL); - if (!dev) { dev_err(&intf->dev, "Disconnect (nodata)\n"); return; From patchwork Sat Dec 3 13:31:55 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Vincent Mailhol X-Patchwork-Id: 13063542 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6AC72C352A1 for ; Sat, 3 Dec 2022 13:33:30 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229822AbiLCNd3 (ORCPT ); Sat, 3 Dec 2022 08:33:29 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:54466 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229820AbiLCNdG (ORCPT ); Sat, 3 Dec 2022 08:33:06 -0500 Received: from mail-pg1-x52e.google.com (mail-pg1-x52e.google.com [IPv6:2607:f8b0:4864:20::52e]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 55FBA17880; Sat, 3 Dec 2022 05:32:46 -0800 (PST) Received: by mail-pg1-x52e.google.com with SMTP id h193so6605285pgc.10; Sat, 03 Dec 2022 05:32:46 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:sender:from:to:cc:subject:date :message-id:reply-to; bh=dOfYV6CW+avnaQrtamVGsJG2bps7tCEFlf1CMaOsNsw=; b=oR3qU0yGIU6iOVxIuVEsaLNO1sG7NxQvlVqOJ80orEIdFjBHtPWRt6o4v19aDO7z6N 1dhba3k9yINO1pkZIQ0NiR+H32RiclgG3wohPdPhJzgd8d18WAnsOqIDo/Y+EwAsKfvX FmC1co2ixcRv9pPMVaA9BnghXnetjra3pLc3powVIXsXnkO4TshoPLjrZgtkcUYWYrZP evduuq2dw704I8aR87KM7UoKzlXt80CXgrmOUAMrXAN/Sw65D1m761T+HkR4pO874yrk nXuVpgrAUqUVnqpvw88qNcHpETQB5yoRX0mW+Xs5UgfrE2eRCOX+EjU3IZ2UXUkPG7Ez FvRQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:sender:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=dOfYV6CW+avnaQrtamVGsJG2bps7tCEFlf1CMaOsNsw=; b=ryq7PeECd42kSnTifxKgG4mhg4HpCHp0WIGIcm6LzECFUK6oT2rRkaX0J45PFfGCG7 XK75f3wFwYNRtkEgYDx9Hpb5F/llJU6rApE2CO8bWD/5tP4uD1Oj94TNvZl/n1kmPH3K JowlrEUqv2VFTyWVVLcyooBu7YLmwTqpXszhkBMzxXVkitUpyR9AB11Q+bK11FD9C/JR 7vjJ1o+aqSV12uhTfvLy6P9weI8Jan/nVdlCDBdtN+YqqBjlZu8DAC5W1WgRUwcJXEDl jNcj2wwoItIU0902vqens/xJSR4vubVkYYZVuyRYGIJxVhUA7XgXeCg8eBAyjdC5+Fq3 bf4g== X-Gm-Message-State: ANoB5pmOA4HnSd+R5r4cFpOJnpUHkNETi7ll3ayeOS0/kMS16LZO9Ag+ IRTBSEpRUhgb4UdqnkC63GY= X-Google-Smtp-Source: AA0mqf5U0iuXdFWuufaxrcdaK69EB+htl31ZfowQde7TbTbB64N+6tZpe49HZfw+UoKEoP/K5vFGHQ== X-Received: by 2002:a63:f40f:0:b0:478:1c89:5c9a with SMTP id g15-20020a63f40f000000b004781c895c9amr25227135pgi.384.1670074365730; Sat, 03 Dec 2022 05:32:45 -0800 (PST) Received: from localhost.localdomain (124x33x176x97.ap124.ftth.ucom.ne.jp. [124.33.176.97]) by smtp.gmail.com with ESMTPSA id q12-20020a170902dacc00b00185402cfedesm7414472plx.246.2022.12.03.05.32.39 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 03 Dec 2022 05:32:45 -0800 (PST) Sender: Vincent Mailhol From: Vincent Mailhol To: Marc Kleine-Budde , linux-can@vger.kernel.org Cc: Wolfgang Grandegger , "David S . Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Frank Jungclaus , socketcan@esd.eu, Yasushi SHOJI , =?utf-8?q?Stefan_M=C3=A4tje?= , Hangyu Hua , Oliver Hartkopp , Peter Fink , Jeroen Hofstee , =?utf-8?q?Christoph_M=C3=B6hring?= , John Whittington , Vasanth Sadhasivan , Jimmy Assarsson , Anssi Hannula , Pavel Skripkin , Stephane Grosjean , Wolfram Sang , "Gustavo A . R . Silva" , Julia Lawall , Dongliang Mu , Sebastian Haas , Maximilian Schneider , Daniel Berglund , Olivier Sobrie , =?utf-8?b?UmVtaWdpdXN6IEtvxYLFgsSFdGFq?= , Jakob Unterwurzacher , Martin Elshuber , Philipp Tomsich , Bernd Krumboeck , netdev@vger.kernel.org, linux-kernel@vger.kernel.org, Alan Stern , linux-usb@vger.kernel.org, Vincent Mailhol Subject: [PATCH 4/8] can: kvaser_usb: kvaser_usb_disconnect(): fix NULL pointer dereference Date: Sat, 3 Dec 2022 22:31:55 +0900 Message-Id: <20221203133159.94414-5-mailhol.vincent@wanadoo.fr> X-Mailer: git-send-email 2.37.4 In-Reply-To: <20221203133159.94414-1-mailhol.vincent@wanadoo.fr> References: <20221203133159.94414-1-mailhol.vincent@wanadoo.fr> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: linux-usb@vger.kernel.org kvaser_usb sets the usb_interface to NULL before waiting for the completion of outstanding urbs. This can result in NULL pointer dereference, c.f. [1] and [2]. Remove the call to usb_set_intfdata(intf, NULL). The core will take care of setting it to NULL after kvaser_usb_disconnect() at [3]. [1] commit 27ef17849779 ("usb: add usb_set_intfdata() documentation") Link: https://git.kernel.org/gregkh/usb/c/27ef17849779 [2] thread about usb_set_intfdata() on linux-usb mailing. Link: https://lore.kernel.org/linux-usb/Y4OD70GD4KnoRk0k@rowland.harvard.edu/ [3] function usb_unbind_interface() from drivers/usb/core/driver.c Link: https://elixir.bootlin.com/linux/v6.0/source/drivers/usb/core/driver.c#L497 Fixes: 080f40a6fa28 ("can: kvaser_usb: Add support for Kvaser CAN/USB devices") Signed-off-by: Vincent Mailhol --- @stable team: the function was moved from kvaser_usb.c to kvaser_usb_core.c in: 7259124eac7d1 ("can: kvaser_usb: Split driver into kvaser_usb_core.c and kvaser_usb_leaf.c") --- drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c | 2 -- 1 file changed, 2 deletions(-) diff --git a/drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c b/drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c index 3a2bfaad1406..dad916b3288e 100644 --- a/drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c +++ b/drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c @@ -981,8 +981,6 @@ static void kvaser_usb_disconnect(struct usb_interface *intf) { struct kvaser_usb *dev = usb_get_intfdata(intf); - usb_set_intfdata(intf, NULL); - if (!dev) return; From patchwork Sat Dec 3 13:31:56 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Vincent Mailhol X-Patchwork-Id: 13063543 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 1B3EDC47088 for ; Sat, 3 Dec 2022 13:33:55 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229877AbiLCNdw (ORCPT ); Sat, 3 Dec 2022 08:33:52 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:54418 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229835AbiLCNdY (ORCPT ); Sat, 3 Dec 2022 08:33:24 -0500 Received: from mail-pg1-x52b.google.com (mail-pg1-x52b.google.com [IPv6:2607:f8b0:4864:20::52b]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 3CE551EAF7; Sat, 3 Dec 2022 05:32:53 -0800 (PST) Received: by mail-pg1-x52b.google.com with SMTP id r18so6599632pgr.12; Sat, 03 Dec 2022 05:32:53 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:sender:from:to:cc:subject:date :message-id:reply-to; bh=eF9XShE5TJVkfnfRnJlkYlYYSsfKbTDmFNqULVnSW+E=; b=qCVa8HcyTJPvaxUsBydSGsuhXbxjTWPrYKA/b2wF5kUy0UWg5wRLqjNL6rZRlwxX8e v0EZNF6FPAzyLIMGqfxKiVhMlIjtKA5LNEq7y2/kdNto4pklx7bsgbRVf9F3FAjBAXgQ eq/B5hKXAxVkyzE0m44vtQEfgxYszsH4bVXJS+QP5DP6gJqLX0HTUVqUviOJcIOUCTO4 8F4hn39Oe+zSWsV+DDxiA0+1lQcyjlviSXn2Rz0NSjy9R8SyQCTts6Xmzwx9qhHsBLFX mG7EVUWVSTbZ+xVrmhSmXkZnqJaUnD5P0LquuSB0pMDnsSG0W6ovLs93/B3JxWWPFAWN LUzQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:sender:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=eF9XShE5TJVkfnfRnJlkYlYYSsfKbTDmFNqULVnSW+E=; b=V7P0EsyiFwO2YIuHHgOJysa8OO8qRnKJ7gtgRQEXBkiqBcNM9WX1InJxteNgmjpfYR +42I7YlKz3CDm+xS2VfkX+nBFdm/BhruQhGPiSvjSboqNlwJ1wMdH7JUFJvD2d1Quicw 6wUoewTTmlfdI+1wY/RJNJ9E8ekNq4Y17w/IK+MkyfXumUaPCLHYLaHE/RC8YtEoMdz4 lhZZ3G7nKYqt+ilqDgq+KZJbS89bfZs4AOPJOOI+gGfGir505/QRgbg8tT47lMH+hhl1 XyBETm2dxcGcqwpzbP4ReL47+PD2XsMwvSaXskCzJIovoRuckizyaTDxmeBOYGhZj9u3 dQbg== X-Gm-Message-State: ANoB5plhTviFBVQ/g53llBT1zCis5xgIVUgFP10/R2NU0N7WN6Sy7mE1 +j50FEsNwPkgvB2H6512dbM= X-Google-Smtp-Source: AA0mqf6yBRx7vd+hKPw5cCnOi+O438dLHdlH19SDLTH0Wupse3Q+/hj/PAxljBNAtn/pnWlxhiJwXg== X-Received: by 2002:a05:6a00:1624:b0:573:993b:ea6d with SMTP id e4-20020a056a00162400b00573993bea6dmr58237780pfc.10.1670074372733; Sat, 03 Dec 2022 05:32:52 -0800 (PST) Received: from localhost.localdomain (124x33x176x97.ap124.ftth.ucom.ne.jp. [124.33.176.97]) by smtp.gmail.com with ESMTPSA id q12-20020a170902dacc00b00185402cfedesm7414472plx.246.2022.12.03.05.32.46 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 03 Dec 2022 05:32:52 -0800 (PST) Sender: Vincent Mailhol From: Vincent Mailhol To: Marc Kleine-Budde , linux-can@vger.kernel.org Cc: Wolfgang Grandegger , "David S . Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Frank Jungclaus , socketcan@esd.eu, Yasushi SHOJI , =?utf-8?q?Stefan_M=C3=A4tje?= , Hangyu Hua , Oliver Hartkopp , Peter Fink , Jeroen Hofstee , =?utf-8?q?Christoph_M=C3=B6hring?= , John Whittington , Vasanth Sadhasivan , Jimmy Assarsson , Anssi Hannula , Pavel Skripkin , Stephane Grosjean , Wolfram Sang , "Gustavo A . R . Silva" , Julia Lawall , Dongliang Mu , Sebastian Haas , Maximilian Schneider , Daniel Berglund , Olivier Sobrie , =?utf-8?b?UmVtaWdpdXN6IEtvxYLFgsSFdGFq?= , Jakob Unterwurzacher , Martin Elshuber , Philipp Tomsich , Bernd Krumboeck , netdev@vger.kernel.org, linux-kernel@vger.kernel.org, Alan Stern , linux-usb@vger.kernel.org, Vincent Mailhol Subject: [PATCH 5/8] can: mcba_usb: mcba_usb_disconnect(): fix NULL pointer dereference Date: Sat, 3 Dec 2022 22:31:56 +0900 Message-Id: <20221203133159.94414-6-mailhol.vincent@wanadoo.fr> X-Mailer: git-send-email 2.37.4 In-Reply-To: <20221203133159.94414-1-mailhol.vincent@wanadoo.fr> References: <20221203133159.94414-1-mailhol.vincent@wanadoo.fr> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: linux-usb@vger.kernel.org mcba_usb sets the usb_interface to NULL before waiting for the completion of outstanding urbs. This can result in NULL pointer dereference, c.f. [1] and [2]. Remove the call to usb_set_intfdata(intf, NULL). The core will take care of setting it to NULL after mcba_usb_disconnect() at [3]. [1] commit 27ef17849779 ("usb: add usb_set_intfdata() documentation") Link: https://git.kernel.org/gregkh/usb/c/27ef17849779 [2] thread about usb_set_intfdata() on linux-usb mailing. Link: https://lore.kernel.org/linux-usb/Y4OD70GD4KnoRk0k@rowland.harvard.edu/ [3] function usb_unbind_interface() from drivers/usb/core/driver.c Link: https://elixir.bootlin.com/linux/v6.0/source/drivers/usb/core/driver.c#L497 Fixes: 51f3baad7de9 ("can: mcba_usb: Add support for Microchip CAN BUS Analyzer") Signed-off-by: Vincent Mailhol --- drivers/net/can/usb/mcba_usb.c | 2 -- 1 file changed, 2 deletions(-) diff --git a/drivers/net/can/usb/mcba_usb.c b/drivers/net/can/usb/mcba_usb.c index 47619e9cb005..a21c1ad4894f 100644 --- a/drivers/net/can/usb/mcba_usb.c +++ b/drivers/net/can/usb/mcba_usb.c @@ -890,8 +890,6 @@ static void mcba_usb_disconnect(struct usb_interface *intf) { struct mcba_priv *priv = usb_get_intfdata(intf); - usb_set_intfdata(intf, NULL); - netdev_info(priv->netdev, "device disconnected\n"); unregister_candev(priv->netdev); From patchwork Sat Dec 3 13:31:57 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Vincent Mailhol X-Patchwork-Id: 13063544 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0DED3C47088 for ; Sat, 3 Dec 2022 13:34:08 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229897AbiLCNeG (ORCPT ); Sat, 3 Dec 2022 08:34:06 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:54272 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229767AbiLCNdm (ORCPT ); Sat, 3 Dec 2022 08:33:42 -0500 Received: from mail-pg1-x52e.google.com (mail-pg1-x52e.google.com [IPv6:2607:f8b0:4864:20::52e]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 5C4B322511; Sat, 3 Dec 2022 05:33:00 -0800 (PST) Received: by mail-pg1-x52e.google.com with SMTP id 82so6668813pgc.0; Sat, 03 Dec 2022 05:33:00 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:sender:from:to:cc:subject:date :message-id:reply-to; bh=AUGXSmp1ZJ/eYw9KYmVeYUew9c/fKsHy+JMyV+9A5gU=; b=p88mR7C9zUmDCLuVxmPNdnLSBxBsfuHJ2Vb1NG7ek7qBN0HXp+UAqMreKcwbhBX6Nr BVxcl1WzQykRnSBa+xQxpLnFmpBhcyFJtf40/FFweBzbhzTFYwGfW4YjNzpEfdMUwoBb AZ17g+qUNP58/IG6Kiqf3hoHCYNJbf+qRCx2IsDAqWkksqBYLgUAQPQq5E0JqLlOB4Ua 0gEgoX0kuhc/x8MwM6d/59mPQw4pEGF028F7x+4i6zLEenehjJe2yiVLP0mmo1uq75Qh 2Ctv1dGEm/IIyfZNRTwX0wbsT4SNVQgj45ixLLbhA/SsZtxBZqISLv5oc4R4C1PSUDe5 I57A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:sender:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=AUGXSmp1ZJ/eYw9KYmVeYUew9c/fKsHy+JMyV+9A5gU=; b=BMjp0RcUk6zqZHwUGIJVa6b3Sc0QSH7mxFK5ckKFz1YfXLgyZ5QC7C04CyNRzmNgfK Xp80IiJrMWJw9sVT4kAGZzagcQSeL44/LhflSAUjdGdUmrD618ekouxZgOV7GgFWxoW8 hEZnzyOAWirK/b/4Qw8Vf27n/sW+rBqZ/NvTv1w/T4+A9cZxmuTLLK4wsTo6rD0ddDA4 o11tPbgsHnKmbSrAzPV2jmwD5Lzf15aqxZnNeX8+YiRAFM1FyHtbDuRQgGUvy5ZrekXn 72PZLqT1ekK+BUVlnL1XRp/YPXLJqqyjDBAGepEMdfUZ+WrN4XcevgSk28lUbeklPC0h VYMA== X-Gm-Message-State: ANoB5pk3gIv3GWCnqYrm3lnd3NWQiUd36/MRtcAa/XzaPVg97ViuBi+c X/0ZrZDRBFM8POS8Whb/RBM= X-Google-Smtp-Source: AA0mqf7UqEufAxToFJc9AlhYIYdD6c5zlMOTYkrBADevjz6aVVsggEY3ROUFVVTJY/LM8yEooT6cOA== X-Received: by 2002:a63:fc14:0:b0:477:86c1:640c with SMTP id j20-20020a63fc14000000b0047786c1640cmr48540634pgi.226.1670074379752; Sat, 03 Dec 2022 05:32:59 -0800 (PST) Received: from localhost.localdomain (124x33x176x97.ap124.ftth.ucom.ne.jp. [124.33.176.97]) by smtp.gmail.com with ESMTPSA id q12-20020a170902dacc00b00185402cfedesm7414472plx.246.2022.12.03.05.32.53 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 03 Dec 2022 05:32:59 -0800 (PST) Sender: Vincent Mailhol From: Vincent Mailhol To: Marc Kleine-Budde , linux-can@vger.kernel.org Cc: Wolfgang Grandegger , "David S . Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Frank Jungclaus , socketcan@esd.eu, Yasushi SHOJI , =?utf-8?q?Stefan_M=C3=A4tje?= , Hangyu Hua , Oliver Hartkopp , Peter Fink , Jeroen Hofstee , =?utf-8?q?Christoph_M=C3=B6hring?= , John Whittington , Vasanth Sadhasivan , Jimmy Assarsson , Anssi Hannula , Pavel Skripkin , Stephane Grosjean , Wolfram Sang , "Gustavo A . R . Silva" , Julia Lawall , Dongliang Mu , Sebastian Haas , Maximilian Schneider , Daniel Berglund , Olivier Sobrie , =?utf-8?b?UmVtaWdpdXN6IEtvxYLFgsSFdGFq?= , Jakob Unterwurzacher , Martin Elshuber , Philipp Tomsich , Bernd Krumboeck , netdev@vger.kernel.org, linux-kernel@vger.kernel.org, Alan Stern , linux-usb@vger.kernel.org, Vincent Mailhol Subject: [PATCH 6/8] can: ucan: ucan_disconnect(): fix NULL pointer dereference Date: Sat, 3 Dec 2022 22:31:57 +0900 Message-Id: <20221203133159.94414-7-mailhol.vincent@wanadoo.fr> X-Mailer: git-send-email 2.37.4 In-Reply-To: <20221203133159.94414-1-mailhol.vincent@wanadoo.fr> References: <20221203133159.94414-1-mailhol.vincent@wanadoo.fr> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: linux-usb@vger.kernel.org ucan sets the usb_interface to NULL before waiting for the completion of outstanding urbs. This can result in NULL pointer dereference, c.f. [1] and [2]. Remove the call to usb_set_intfdata(intf, NULL). The core will take care of setting it to NULL after ucan_disconnect() at [3]. [1] commit 27ef17849779 ("usb: add usb_set_intfdata() documentation") Link: https://git.kernel.org/gregkh/usb/c/27ef17849779 [2] thread about usb_set_intfdata() on linux-usb mailing. Link: https://lore.kernel.org/linux-usb/Y4OD70GD4KnoRk0k@rowland.harvard.edu/ [3] function usb_unbind_interface() from drivers/usb/core/driver.c Link: https://elixir.bootlin.com/linux/v6.0/source/drivers/usb/core/driver.c#L497 Fixes: 9f2d3eae88d2 ("can: ucan: add driver for Theobroma Systems UCAN devices") Signed-off-by: Vincent Mailhol --- drivers/net/can/usb/ucan.c | 2 -- 1 file changed, 2 deletions(-) diff --git a/drivers/net/can/usb/ucan.c b/drivers/net/can/usb/ucan.c index ffa38f533c35..429b3519ee7f 100644 --- a/drivers/net/can/usb/ucan.c +++ b/drivers/net/can/usb/ucan.c @@ -1579,8 +1579,6 @@ static void ucan_disconnect(struct usb_interface *intf) { struct ucan_priv *up = usb_get_intfdata(intf); - usb_set_intfdata(intf, NULL); - if (up) { unregister_candev(up->netdev); free_candev(up->netdev); From patchwork Sat Dec 3 13:31:58 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Vincent Mailhol X-Patchwork-Id: 13063545 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 01C07C47090 for ; Sat, 3 Dec 2022 13:34:10 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229861AbiLCNeJ (ORCPT ); Sat, 3 Dec 2022 08:34:09 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:54286 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229775AbiLCNdp (ORCPT ); Sat, 3 Dec 2022 08:33:45 -0500 Received: from mail-pj1-x1034.google.com (mail-pj1-x1034.google.com [IPv6:2607:f8b0:4864:20::1034]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 6977D32B87; Sat, 3 Dec 2022 05:33:07 -0800 (PST) Received: by mail-pj1-x1034.google.com with SMTP id k2-20020a17090a4c8200b002187cce2f92so10810121pjh.2; Sat, 03 Dec 2022 05:33:07 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:sender:from:to:cc:subject:date :message-id:reply-to; bh=3fxHyzRD+OA0ZiW4eG2/9faFb16Ofuaf9BEH5sngLak=; b=HOT0P6wpuwAHMJkR5T7OtYtanEI2rfVIg+ru6zxJLZukWem+R65baDM40tZWQaoQXF XCwmBPo56lSEFwZ9mkHiPLG8WVexDl5yb2sg1Gi4x0SW+unyu8AibTSIqinlgKaIo78i 2rFCUDla5mRhthb8F3eo+eV+51m7JP2QDu0joDCvRLwrrO0Z/H97X0DfAaeRKk9YF3e4 Uao4WPnUnO4n8Adbg1xfjvE+Z+JOt9YV8rP2QPQNhrtRRsYnQsa5mWOS5rgHKWj4db4u 1CKg9nWZPoJZOUSK9hLPaS7k//Tn+DN9BMLVDOVpKAbjXja/lE/5AjeYnHmcaIrVz8NU k6VQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:sender:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=3fxHyzRD+OA0ZiW4eG2/9faFb16Ofuaf9BEH5sngLak=; b=UEfTn++PwkDUxMN4cDfU15pIH/vR+o7Joz7yhkqYeak+GUcYf+4BddOEiGhDW8v7az 68Ju8h77rrvXHyxEa0iI6kPpNbxXlu+RZq6bRNMMQJfTHAdQ0g7YJOAt6df9bn8LExmT mE9nXFxD2WolwLsswQaf1Nlis68OMgmk/PmplzELyOZTULjsPXPIYoIj8BXn6JpmECFC jamFVFqiy0tG0BMcvoZoExILFFd5PNltRUoMp71kEZ+b1v9L4w+B5OB6UfM0LV0vj5wp PGhpoBW/dU7pbUUeYRfD3D5y60hMFeyZDnmQ1THIfwjoC6vNfex1xb9i/EL4j2G90FFl d/mw== X-Gm-Message-State: ANoB5pnCjz8bSQGA3pPwJeoSovwj0EfhOtOwblUJY+57Zf8w/nZLv6h/ diWvJZ2P6+lRpAbxywGk+98NYfjO+tKNjQ== X-Google-Smtp-Source: AA0mqf7gBuprbi8zQWvCsrE9FrQAOJzeJcPQS8Nl3G2KyFkIPUBY09D/wPreD9zLisOrLdvRv5LgZg== X-Received: by 2002:a17:903:2651:b0:189:acbc:f032 with SMTP id je17-20020a170903265100b00189acbcf032mr16684607plb.9.1670074386824; Sat, 03 Dec 2022 05:33:06 -0800 (PST) Received: from localhost.localdomain (124x33x176x97.ap124.ftth.ucom.ne.jp. [124.33.176.97]) by smtp.gmail.com with ESMTPSA id q12-20020a170902dacc00b00185402cfedesm7414472plx.246.2022.12.03.05.33.00 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 03 Dec 2022 05:33:06 -0800 (PST) Sender: Vincent Mailhol From: Vincent Mailhol To: Marc Kleine-Budde , linux-can@vger.kernel.org Cc: Wolfgang Grandegger , "David S . Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Frank Jungclaus , socketcan@esd.eu, Yasushi SHOJI , =?utf-8?q?Stefan_M=C3=A4tje?= , Hangyu Hua , Oliver Hartkopp , Peter Fink , Jeroen Hofstee , =?utf-8?q?Christoph_M=C3=B6hring?= , John Whittington , Vasanth Sadhasivan , Jimmy Assarsson , Anssi Hannula , Pavel Skripkin , Stephane Grosjean , Wolfram Sang , "Gustavo A . R . Silva" , Julia Lawall , Dongliang Mu , Sebastian Haas , Maximilian Schneider , Daniel Berglund , Olivier Sobrie , =?utf-8?b?UmVtaWdpdXN6IEtvxYLFgsSFdGFq?= , Jakob Unterwurzacher , Martin Elshuber , Philipp Tomsich , Bernd Krumboeck , netdev@vger.kernel.org, linux-kernel@vger.kernel.org, Alan Stern , linux-usb@vger.kernel.org, Vincent Mailhol Subject: [PATCH 7/8] can: usb_8dev: usb_8dev_disconnect(): fix NULL pointer dereference Date: Sat, 3 Dec 2022 22:31:58 +0900 Message-Id: <20221203133159.94414-8-mailhol.vincent@wanadoo.fr> X-Mailer: git-send-email 2.37.4 In-Reply-To: <20221203133159.94414-1-mailhol.vincent@wanadoo.fr> References: <20221203133159.94414-1-mailhol.vincent@wanadoo.fr> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: linux-usb@vger.kernel.org usb_8dev sets the usb_interface to NULL before waiting for the completion of outstanding urbs. This can result in NULL pointer dereference, c.f. [1] and [2]. Remove the call to usb_set_intfdata(intf, NULL). The core will take care of setting it to NULL after usb_8dev_disconnect() at [3]. [1] commit 27ef17849779 ("usb: add usb_set_intfdata() documentation") Link: https://git.kernel.org/gregkh/usb/c/27ef17849779 [2] thread about usb_set_intfdata() on linux-usb mailing. Link: https://lore.kernel.org/linux-usb/Y4OD70GD4KnoRk0k@rowland.harvard.edu/ [3] function usb_unbind_interface() from drivers/usb/core/driver.c Link: https://elixir.bootlin.com/linux/v6.0/source/drivers/usb/core/driver.c#L497 Fixes: 0024d8ad1639 ("can: usb_8dev: Add support for USB2CAN interface from 8 devices") Signed-off-by: Vincent Mailhol --- drivers/net/can/usb/usb_8dev.c | 2 -- 1 file changed, 2 deletions(-) diff --git a/drivers/net/can/usb/usb_8dev.c b/drivers/net/can/usb/usb_8dev.c index 8a5596ce4e46..ae618809fc05 100644 --- a/drivers/net/can/usb/usb_8dev.c +++ b/drivers/net/can/usb/usb_8dev.c @@ -990,8 +990,6 @@ static void usb_8dev_disconnect(struct usb_interface *intf) { struct usb_8dev_priv *priv = usb_get_intfdata(intf); - usb_set_intfdata(intf, NULL); - if (priv) { netdev_info(priv->netdev, "device disconnected\n"); From patchwork Sat Dec 3 13:31:59 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Vincent Mailhol X-Patchwork-Id: 13063546 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 9974DC47088 for ; Sat, 3 Dec 2022 13:34:31 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229833AbiLCNea (ORCPT ); Sat, 3 Dec 2022 08:34:30 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:55522 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229829AbiLCNdu (ORCPT ); Sat, 3 Dec 2022 08:33:50 -0500 Received: from mail-pf1-x430.google.com (mail-pf1-x430.google.com [IPv6:2607:f8b0:4864:20::430]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 6A7A936C50; Sat, 3 Dec 2022 05:33:14 -0800 (PST) Received: by mail-pf1-x430.google.com with SMTP id a14so3319458pfa.1; Sat, 03 Dec 2022 05:33:14 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:sender:from:to:cc:subject:date :message-id:reply-to; bh=TT8CxN+zmR4GrrxzUdFUbZUJEcfWOEsYz1q7FCNTvzo=; b=DFLXM+OTbYQJOTlqVLpbrXaSeohYWmcJvZ+jS0JNZIMSBtykQFUTRRVJlJKPnbFIGq NlHcUNbfSyHsDCrHoG2cvPEUOdyzOMnhl3BSEqOwb7eR7tIuWPEHuSeE8pmTvn54cKdH kWa2adMlCuNPrlvsZc6Be8CkGhiQQRcK18MLOTEl2s483kpm2et3ZazQkKYDCoeKRi8j a8cfBqYbjMzIfLU7ZfojSCgos5wGeSTVi184RjR2K1Yohs+t+jKD+uMBm6KkzE7/2xC9 vCk8iqhGoPKaHb4n+QZXwaYk4E3bm3+Y4lqcyMzGCWXXB9r2mQQVT+7tHbDUN63+Rj1f XSkw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:sender:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=TT8CxN+zmR4GrrxzUdFUbZUJEcfWOEsYz1q7FCNTvzo=; b=H1o3gthcI3oXdORYKIE/RgwGlVvxXKiT11m3O+ZmWZXD4a9tm6gernthxIpa4Fr+4j sBX7MQ1jAu9vHxTTJiW3a4HSvUMQNVNgPnRqROWrLzfKYokaPCrScRXhieTm658yRcUk PonkFd40sg9zCTO4OyqWEKb+RpBbULOkNgJe6ktDeJWVxhVWVPFBTgFLnmqhS9s3X3CV osmmcDwBY7Qd85gJKxlvEj/mroPDEjhDrhyPk+NP0Cr7esfoB4UcaqFNIS8uSR92DeOO RkHCHgC8MSplg0bX0EyHCg9+GJk/K9wYUk+zOokrMZcbLndJmwMbVR919+xpwKvKuRA6 PIPA== X-Gm-Message-State: ANoB5pnbxStfsGin2F1lYhNNBw3FAX0G00JVnCD6zqceVkC1Enbm3iXQ lRctmvWRg502npRwuemT30g= X-Google-Smtp-Source: AA0mqf79UzNRO2eymOBMzSHWgk6BjcbIV4dLABYx3/wgG5dQCbuXgduuI0sr7Cbyrj0fhNt9RW4tFw== X-Received: by 2002:a05:6a00:1696:b0:53e:6656:d829 with SMTP id k22-20020a056a00169600b0053e6656d829mr79016294pfc.63.1670074393805; Sat, 03 Dec 2022 05:33:13 -0800 (PST) Received: from localhost.localdomain (124x33x176x97.ap124.ftth.ucom.ne.jp. [124.33.176.97]) by smtp.gmail.com with ESMTPSA id q12-20020a170902dacc00b00185402cfedesm7414472plx.246.2022.12.03.05.33.07 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 03 Dec 2022 05:33:13 -0800 (PST) Sender: Vincent Mailhol From: Vincent Mailhol To: Marc Kleine-Budde , linux-can@vger.kernel.org Cc: Wolfgang Grandegger , "David S . Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Frank Jungclaus , socketcan@esd.eu, Yasushi SHOJI , =?utf-8?q?Stefan_M=C3=A4tje?= , Hangyu Hua , Oliver Hartkopp , Peter Fink , Jeroen Hofstee , =?utf-8?q?Christoph_M=C3=B6hring?= , John Whittington , Vasanth Sadhasivan , Jimmy Assarsson , Anssi Hannula , Pavel Skripkin , Stephane Grosjean , Wolfram Sang , "Gustavo A . R . Silva" , Julia Lawall , Dongliang Mu , Sebastian Haas , Maximilian Schneider , Daniel Berglund , Olivier Sobrie , =?utf-8?b?UmVtaWdpdXN6IEtvxYLFgsSFdGFq?= , Jakob Unterwurzacher , Martin Elshuber , Philipp Tomsich , Bernd Krumboeck , netdev@vger.kernel.org, linux-kernel@vger.kernel.org, Alan Stern , linux-usb@vger.kernel.org, Vincent Mailhol Subject: [PATCH 8/8] can: etas_es58x and peak_usb: remove useless call to usb_set_intfdata() Date: Sat, 3 Dec 2022 22:31:59 +0900 Message-Id: <20221203133159.94414-9-mailhol.vincent@wanadoo.fr> X-Mailer: git-send-email 2.37.4 In-Reply-To: <20221203133159.94414-1-mailhol.vincent@wanadoo.fr> References: <20221203133159.94414-1-mailhol.vincent@wanadoo.fr> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: linux-usb@vger.kernel.org The core sets the usb_interface to NULL in [1]. Also setting it to NULL in usb_driver::disconnect() is useless. Remove the calls to usb_set_intfdata(intf, NULL) in the disconnect functions of all drivers under drivers/net/can/usb, namely etas_es58x and peak_usb. [1] function usb_unbind_interface() from drivers/usb/core/driver.c Link: https://elixir.bootlin.com/linux/v6.0/source/drivers/usb/core/driver.c#L497 Signed-off-by: Vincent Mailhol --- drivers/net/can/usb/etas_es58x/es58x_core.c | 1 - drivers/net/can/usb/peak_usb/pcan_usb_core.c | 2 -- 2 files changed, 3 deletions(-) diff --git a/drivers/net/can/usb/etas_es58x/es58x_core.c b/drivers/net/can/usb/etas_es58x/es58x_core.c index 0c7f7505632c..4924f0be3510 100644 --- a/drivers/net/can/usb/etas_es58x/es58x_core.c +++ b/drivers/net/can/usb/etas_es58x/es58x_core.c @@ -2257,7 +2257,6 @@ static void es58x_disconnect(struct usb_interface *intf) es58x_free_netdevs(es58x_dev); es58x_free_urbs(es58x_dev); devlink_free(priv_to_devlink(es58x_dev)); - usb_set_intfdata(intf, NULL); } static struct usb_driver es58x_driver = { diff --git a/drivers/net/can/usb/peak_usb/pcan_usb_core.c b/drivers/net/can/usb/peak_usb/pcan_usb_core.c index 1d996d3320fe..c15200aebfb6 100644 --- a/drivers/net/can/usb/peak_usb/pcan_usb_core.c +++ b/drivers/net/can/usb/peak_usb/pcan_usb_core.c @@ -974,8 +974,6 @@ static void peak_usb_disconnect(struct usb_interface *intf) free_candev(netdev); dev_info(&intf->dev, "%s removed\n", name); } - - usb_set_intfdata(intf, NULL); } /*