From: Greg KH <greg@kroah•com>
To: Grant Grundler <grundler@chromium•org>
Cc: netdev@vger•kernel.org, linux-usb@vger•kernel.org
Subject: Re: 3.0.8 kernel : NULL ptr deref in skb_queue_purge()
Date: Thu, 8 Dec 2011 13:35:27 -0800 [thread overview]
Message-ID: <20111208213527.GA20721@kroah.com> (raw)
In-Reply-To: <CANEJEGvNePLb9KcMO-sGSN81y6mb_zaHHQVujSbJXcCwh3Xcmw@mail.gmail.com>
On Thu, Dec 08, 2011 at 11:04:48AM -0800, Grant Grundler wrote:
> On Thu, Dec 8, 2011 at 10:02 AM, Greg KH <greg@kroah•com> wrote:
> > On Wed, Dec 07, 2011 at 02:40:49PM -0800, Grant Grundler wrote:
> >> Hi,
> >> I'm testing asix (USB 100BT ethernet adapter with AX88772) driver
> >> initialization (and shut down) paths and reproduced a
> >> "skb_queue_purge" panic 3 times after a few hundred/thousand
> >> iterations of rmmod/modprobe. I'm inclined to believe
> >> skb_queue_purge() is a victim and not a culprit here.
> >>
> >> I don't know if all 3 "spontaneous reboots" I've seen have the same
> >> stack trace as the one I have a record for:
> >
> > Have you tried this on 3.1, and especially, 3.2-rc?
>
> Hi Greg,
> I haven't tried any thing later yet. I would consider it if someone
> could point at a change(s) that might be relevant to the symptom.
>
>
> > A number of asix
> > patches have gone into the 3.2-rc series, perhaps they might have
> > resolved this problem already?
>
> I'm the one who submitted those changes. :)
Heh, oops, sorry about that :)
> asix.c driver I'm testing was pulled directly from davem's net-next
> tree and I believe that's what is in 3.2-rc series now.
>
> Those changes only relate to AX88772 and AX88178 bind and reset code.
> suspend/resume support is unchanged - though I suspect ax*_reset
> functions get called in resume.
>
> It's possible this code path in asix.c has *always* been broken. I see
> two drivesr/net/usbnet USB drivers that do this:
>
> drivers/net/usb/cdc_ether.c 614 .reset_resume = usbnet_resume,
> drivers/net/usb/cdc_ncm.c 1193 .reset_resume = usbnet_resume,
>
> Even though most usbnet drivers don't, I'm tempted to add this code
> and "just try it":
Let us know if that works or not.
thanks,
greg k-h
next prev parent reply other threads:[~2011-12-08 21:43 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2011-12-07 22:40 3.0.8 kernel : NULL ptr deref in skb_queue_purge() Grant Grundler
[not found] ` <CANEJEGtJ3UmFNyui_SaZ6NF5FFVjZ+_UBg1RC2eif5Lu1YKDsQ-JsoAwUIsXosN+BqQ9rBEUg@public.gmane.org>
2011-12-08 18:02 ` Greg KH
2011-12-08 19:04 ` Grant Grundler
2011-12-08 21:35 ` Greg KH [this message]
2011-12-13 0:30 ` Grant Grundler
2012-01-06 21:19 ` Grant Grundler
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20111208213527.GA20721@kroah.com \
--to=greg@kroah$(echo .)com \
--cc=grundler@chromium$(echo .)org \
--cc=linux-usb@vger$(echo .)kernel.org \
--cc=netdev@vger$(echo .)kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox