Subject: Re: 3.0.8 kernel : NULL ptr deref in skb_queue_purge()

From: Greg KH <[email-masked]>
Date: Thu, 8 Dec 2011 13:35:27 -0800

On Thu, Dec 08, 2011 at 11:04:48AM -0800, Grant Grundler wrote:
> On Thu, Dec 8, 2011 at 10:02 AM, Greg KH <[email-masked]> wrote:
> > On Wed, Dec 07, 2011 at 02:40:49PM -0800, Grant Grundler wrote:
> >> Hi,
> >> I'm testing asix (USB 100BT ethernet adapter with AX88772) driver
> >> initialization (and shut down) paths and reproduced a
> >> "skb_queue_purge" panic 3 times after a few hundred/thousand
> >> iterations of rmmod/modprobe. I'm inclined to believe
> >> skb_queue_purge() is a victim and not a culprit here.
> >>
> >>  I don't know if all 3 "spontaneous reboots" I've seen have the same
> >> stack trace as the one I have a record for:
> >
> > Have you tried this on 3.1, and especially, 3.2-rc?
> 
> Hi Greg,
> I haven't tried any thing later yet.  I would consider it if someone
> could point at a change(s) that might be relevant to the symptom.
> 
> 
> >  A number of asix
> > patches have gone into the 3.2-rc series, perhaps they might have
> > resolved this problem already?
> 
> I'm the one who submitted those changes. :)

Heh, oops, sorry about that :)

> asix.c driver I'm testing was pulled directly from davem's net-next
> tree and I believe that's what is in 3.2-rc series now.
> 
> Those changes only relate to AX88772 and AX88178 bind and reset code.
> suspend/resume support is unchanged  - though I suspect ax*_reset
> functions get called in resume.
> 
> It's possible this code path in asix.c has *always* been broken. I see
> two drivesr/net/usbnet USB drivers that do this:
> 
> drivers/net/usb/cdc_ether.c  614 .reset_resume = usbnet_resume,
> drivers/net/usb/cdc_ncm.c  1193 .reset_resume = usbnet_resume,
> 
> Even though most usbnet drivers don't,  I'm tempted to add this code
> and "just try it":

Let us know if that works or not.

thanks,

greg k-h