On Wed, 27 Aug 2008, Oliver Neukum wrote:

quoted text
> This is a race condition.
> 
> CPU A					CPU B
> open()
> usb_find_interface()
> 						disconnect()
> 						kref_put()
> 						usbtmc_delete()
> 						kfree()
> kref_get()
> 
> You can write to free memory. You must use a static mutex for
> mutual exclusion between open() and disconnect()

Is that necessary?  usbcore includes its own mutual exclusion now.  
Look in file.c at how minor_rwsem is used.

Alan Stern

--
unsubscribe notice
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/