Re: [PATCH] Printer Gadget Driver v0.2.0 (kernel 2.6.21.3)

On Sunday 07 October 2007, Craig W. Nadler wrote:
> static void
> +printer_unbind(struct usb_gadget *gadget)
> +{
> +       ...
> +
> +       /* we've already been disconnected ... no i/o is active */
> +       /* Free all memory for this driver. */
> +       while (likely(!list_empty(&dev->tx_reqs_active))) {
> +               req = container_of(dev->tx_reqs_active.next,
> +                               struct usb_request, list);
> +               ERROR(dev, "Driver still has active transfer left. %p\n", req);
> +               list_del(&req->list);
> +               printer_req_free(dev->in_ep, req);

Since the request is owned by the gadget driver at this point,
freeing the request is dangerous ... it's a bug of the "this
could oops" variety.

Of course, that whole loop is a "should never happen" bug in the
first place.  I'd almost be tempted to BUG() out if that ever
happens; can't imagine any sane way such a controller bug could
be recovered from.  Maybe this is a place the "don't test for
bugs you can't handle" rule should be applied...

> +       }
> +
> +       ...
> +
> +       while (likely(!list_empty(&dev->rx_reqs_active))) {
> +               req = container_of(dev->rx_reqs_active.next,
> +                               struct usb_request, list);
> +               ERROR(dev, "Driver still has active transfer left. %p\n", req);
> +               list_del(&req->list);
> +               printer_req_free(dev->out_ep, req);

Ditto.


To avoid an extra round of pre-merge feedback, what I'll ask
you to do is submit a patch providing a less dangerous way
out of those "should never happen" bugs.

> +       }
> +
> +       ...
> +}



-------------------------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems?  Stop.
Now Search log events and configuration files using AJAX and a browser.
Download your FREE copy of Splunk now >> http://get.splunk.com/
_______________________________________________
[email protected]
To unsubscribe, use the last form field at:
https://lists.sourceforge.net/lists/listinfo/linux-usb-devel