Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S933808AbaFQTah (ORCPT ); Tue, 17 Jun 2014 15:30:37 -0400 Received: from iolanthe.rowland.org ([192.131.102.54]:38753 "HELO iolanthe.rowland.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with SMTP id S932657AbaFQTaf (ORCPT ); Tue, 17 Jun 2014 15:30:35 -0400 Date: Tue, 17 Jun 2014 15:30:34 -0400 (EDT) From: Alan Stern X-X-Sender: stern@iolanthe.rowland.org To: Stephen Warren cc: Tuomas Tynkkynen , Greg Kroah-Hartman , , , Subject: Re: [PATCH] USB: EHCI: tegra: Fix use-after-free in .remove() In-Reply-To: <53A0653F.7090001@wwwdotorg.org> Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Tue, 17 Jun 2014, Stephen Warren wrote: > On 06/17/2014 08:17 AM, Tuomas Tynkkynen wrote: > > The tegra_ehci_hcd structure is located in the private space allocated > > by the core USB code so it must not be accessed after the HCD is > > freed. > > > diff --git a/drivers/usb/host/ehci-tegra.c b/drivers/usb/host/ehci-tegra.c > > This seems to be a persistent problem. Witness commit ecc8a0cdca18 "usb: > host: tegra: fix warning messages in ehci_remove". So, I wonder if ... > > > @@ -479,10 +479,11 @@ static int tegra_ehci_remove(struct platform_device *pdev) > > > > usb_phy_shutdown(hcd->phy); > > usb_remove_hcd(hcd); > > - usb_put_hcd(hcd); > > > > clk_disable_unprepare(tegra->clk); > > > > It's worth putting a comment here: > > /* This must be last, since *tegra is part of *hcd */ > > + usb_put_hcd(hcd); > > + > > return 0; > > } Well, maybe. At this stage it's not too likely that anything will be added after the usb_put_hcd(). > Of course, that could be a separate commit if you want. This affects more than ehci-tegra. The same concept applies to all the EHCI and OHCI platform drivers that use the platform-private area. Alan Stern -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/