Am Mittwoch 27 August 2008 18:06:23 schrieb Alan Stern:
quoted text
> On Wed, 27 Aug 2008, Oliver Neukum wrote:
> 
> > This is a race condition.
> > 
> > CPU A					CPU B
> > open()
> > usb_find_interface()
> > 						disconnect()
> > 						kref_put()
> > 						usbtmc_delete()
> > 						kfree()
> > kref_get()
> > 
> > You can write to free memory. You must use a static mutex for
> > mutual exclusion between open() and disconnect()
> 
> Is that necessary?  usbcore includes its own mutual exclusion now.  
> Look in file.c at how minor_rwsem is used.

This is interesting, the driver simply doesn't  unregister the device.
So it would be needed if the code could be left as it is. As not unregistering
the device is wrong, this will fix the bug.

	Thanks
		Oliver
--
unsubscribe notice
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/