From: Greg KH <gregkh@suse.de>
To: linux-kernel@vger.kernel.org, stable@kernel.org
Cc: Justin Forbes <jmforbes@linuxtx.org>,
Zwane Mwaikambo <zwane@arm.linux.org.uk>,
"Theodore Ts'o" <tytso@mit.edu>,
Randy Dunlap <rdunlap@xenotime.net>,
Dave Jones <davej@redhat.com>,
Chuck Wolber <chuckw@quantumlinux.com>,
Chris Wedgwood <reviews@ml.cw.f00f.org>,
Michael Krufky <mkrufky@linuxtv.org>,
Chuck Ebbert <cebbert@redhat.com>,
Domenico Andreoli <cavokz@gmail.com>,
torvalds@linux-foundation.org, akpm@linux-foundation.org,
alan@lxorguk.ukuu.org.uk, bunk@kernel.org,
Alexey Dobriyan <adobriyan@gmail.com>,
"David S. Miller" <davem@davemloft.net>
Subject: [patch 07/26] Fix ROSE module unload oops.
Date: Wed, 31 Oct 2007 08:11:21 -0700 [thread overview]
Message-ID: <20071031151121.GH2437@kroah.com> (raw)
In-Reply-To: <20071031151015.GA2437@kroah.com>
[-- Attachment #1: fix-rose-module-unload-oops.patch --]
[-- Type: text/plain, Size: 4942 bytes --]
2.6.22-stable review patch. If anyone has any objections, please let us
know.
------------------
From: Alexey Dobriyan <adobriyan@gmail.com>
changeset 891e6a931255238dddd08a7b306871240961a27f from mainline.
Commit a3d384029aa304f8f3f5355d35f0ae274454f7cd aka
"[AX.25]: Fix unchecked rose_add_loopback_neigh uses"
transformed rose_loopback_neigh var into statically allocated one.
However, on unload it will be kfree's which can't work.
Steps to reproduce:
modprobe rose
rmmod rose
BUG: unable to handle kernel NULL pointer dereference at virtual address 00000008
printing eip:
c014c664
*pde = 00000000
Oops: 0000 [#1]
PREEMPT DEBUG_PAGEALLOC
Modules linked in: rose ax25 fan ufs loop usbhid rtc snd_intel8x0 snd_ac97_codec ehci_hcd ac97_bus uhci_hcd thermal usbcore button processor evdev sr_mod cdrom
CPU: 0
EIP: 0060:[<c014c664>] Not tainted VLI
EFLAGS: 00210086 (2.6.23-rc9 #3)
EIP is at kfree+0x48/0xa1
eax: 00000556 ebx: c1734aa0 ecx: f6a5e000 edx: f7082000
esi: 00000000 edi: f9a55d20 ebp: 00200287 esp: f6a5ef28
ds: 007b es: 007b fs: 0000 gs: 0033 ss: 0068
Process rmmod (pid: 1823, ti=f6a5e000 task=f7082000 task.ti=f6a5e000)
Stack: f9a55d20 f9a5200c 00000000 00000000 00000000 f6a5e000 f9a5200c f9a55a00
00000000 bf818cf0 f9a51f3f f9a55a00 00000000 c0132c60 65736f72 00000000
f69f9630 f69f9528 c014244a f6a4e900 00200246 f7082000 c01025e6 00000000
Call Trace:
[<f9a5200c>] rose_rt_free+0x1d/0x49 [rose]
[<f9a5200c>] rose_rt_free+0x1d/0x49 [rose]
[<f9a51f3f>] rose_exit+0x4c/0xd5 [rose]
[<c0132c60>] sys_delete_module+0x15e/0x186
[<c014244a>] remove_vma+0x40/0x45
[<c01025e6>] sysenter_past_esp+0x8f/0x99
[<c012bacf>] trace_hardirqs_on+0x118/0x13b
[<c01025b6>] sysenter_past_esp+0x5f/0x99
=======================
Code: 05 03 1d 80 db 5b c0 8b 03 25 00 40 02 00 3d 00 40 02 00 75 03 8b 5b 0c 8b 73 10 8b 44 24 18 89 44 24 04 9c 5d fa e8 77 df fd ff <8b> 56 08 89 f8 e8 84 f4 fd ff e8 bd 32 06 00 3b 5c 86 60 75 0f
EIP: [<c014c664>] kfree+0x48/0xa1 SS:ESP 0068:f6a5ef28
Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
include/net/rose.h | 2 +-
net/rose/rose_loopback.c | 4 ++--
net/rose/rose_route.c | 15 ++++++++++-----
3 files changed, 13 insertions(+), 8 deletions(-)
--- a/include/net/rose.h
+++ b/include/net/rose.h
@@ -188,7 +188,7 @@ extern void rose_kick(struct sock *);
extern void rose_enquiry_response(struct sock *);
/* rose_route.c */
-extern struct rose_neigh rose_loopback_neigh;
+extern struct rose_neigh *rose_loopback_neigh;
extern const struct file_operations rose_neigh_fops;
extern const struct file_operations rose_nodes_fops;
extern const struct file_operations rose_routes_fops;
--- a/net/rose/rose_loopback.c
+++ b/net/rose/rose_loopback.c
@@ -79,7 +79,7 @@ static void rose_loopback_timer(unsigned
skb_reset_transport_header(skb);
- sk = rose_find_socket(lci_o, &rose_loopback_neigh);
+ sk = rose_find_socket(lci_o, rose_loopback_neigh);
if (sk) {
if (rose_process_rx_frame(sk, skb) == 0)
kfree_skb(skb);
@@ -88,7 +88,7 @@ static void rose_loopback_timer(unsigned
if (frametype == ROSE_CALL_REQUEST) {
if ((dev = rose_dev_get(dest)) != NULL) {
- if (rose_rx_call_request(skb, dev, &rose_loopback_neigh, lci_o) == 0)
+ if (rose_rx_call_request(skb, dev, rose_loopback_neigh, lci_o) == 0)
kfree_skb(skb);
} else {
kfree_skb(skb);
--- a/net/rose/rose_route.c
+++ b/net/rose/rose_route.c
@@ -45,7 +45,7 @@ static DEFINE_SPINLOCK(rose_neigh_list_l
static struct rose_route *rose_route_list;
static DEFINE_SPINLOCK(rose_route_list_lock);
-struct rose_neigh rose_loopback_neigh;
+struct rose_neigh *rose_loopback_neigh;
/*
* Add a new route to a node, and in the process add the node and the
@@ -362,7 +362,12 @@ out:
*/
void rose_add_loopback_neigh(void)
{
- struct rose_neigh *sn = &rose_loopback_neigh;
+ struct rose_neigh *sn;
+
+ rose_loopback_neigh = kmalloc(sizeof(struct rose_neigh), GFP_KERNEL);
+ if (!rose_loopback_neigh)
+ return;
+ sn = rose_loopback_neigh;
sn->callsign = null_ax25_address;
sn->digipeat = NULL;
@@ -417,13 +422,13 @@ int rose_add_loopback_node(rose_address
rose_node->mask = 10;
rose_node->count = 1;
rose_node->loopback = 1;
- rose_node->neighbour[0] = &rose_loopback_neigh;
+ rose_node->neighbour[0] = rose_loopback_neigh;
/* Insert at the head of list. Address is always mask=10 */
rose_node->next = rose_node_list;
rose_node_list = rose_node;
- rose_loopback_neigh.count++;
+ rose_loopback_neigh->count++;
out:
spin_unlock_bh(&rose_node_list_lock);
@@ -454,7 +459,7 @@ void rose_del_loopback_node(rose_address
rose_remove_node(rose_node);
- rose_loopback_neigh.count--;
+ rose_loopback_neigh->count--;
out:
spin_unlock_bh(&rose_node_list_lock);
--
next prev parent reply other threads:[~2007-10-31 15:25 UTC|newest]
Thread overview: 29+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <20071031150535.967437651@mini.kroah.org>
2007-10-31 15:10 ` [patch 00/26] 2.6.22-stable review Greg KH
2007-10-31 15:10 ` [patch 01/26] ACPI: disable lower idle C-states across suspend/resume Greg KH
2007-10-31 15:10 ` [patch 02/26] Fix ESP host instance numbering Greg KH
2007-10-31 15:11 ` [patch 03/26] Fix cls_u32 error return handling Greg KH
2007-10-31 15:11 ` [patch 04/26] Fix ieee80211 handling of bogus hdrlength field Greg KH
2007-10-31 15:11 ` [patch 05/26] Fix some cases of missed IPV6 DAD Greg KH
2007-10-31 15:11 ` [patch 06/26] Fix ipv6 redirect processing, leads to TAHI failures Greg KH
2007-10-31 15:11 ` Greg KH [this message]
2007-10-31 15:11 ` [patch 08/26] Fix zero length socket write() semantics Greg KH
2007-10-31 15:11 ` [patch 09/26] Fix sys_ipc() SEMCTL on sparc64 Greg KH
2007-10-31 15:11 ` [patch 10/26] Fix TCPs ->fastpath_cnt_hit handling Greg KH
2007-10-31 15:11 ` [patch 11/26] : Fix TCP MD5 on big-endian Greg KH
2007-10-31 15:11 ` [patch 12/26] : Fix TCP initial sequence number selection Greg KH
2007-10-31 15:11 ` [patch 13/26] mac80211: filter locally-originated multicast frames Greg KH
2007-10-31 15:11 ` [patch 14/26] libertas: fix endianness breakage Greg KH
2007-10-31 15:11 ` [patch 15/26] libertas: more " Greg KH
2007-10-31 15:11 ` [patch 16/26] Add get_unaligned to ieee80211_get_radiotap_len Greg KH
2007-10-31 15:11 ` [patch 17/26] firewire: fix unloading of fw-ohci while devices are attached Greg KH
2007-10-31 15:12 ` [patch 18/26] netdrvr: natsemi: Fix device removal bug Greg KH
2007-10-31 15:12 ` [patch 19/26] dm9601: Fix receive MTU Greg KH
2007-10-31 15:12 ` [patch 20/26] V4L: ivtv: fix udma yuv bug Greg KH
2007-10-31 15:12 ` [patch 21/26] hwmon/lm87: Fix a division by zero Greg KH
2007-10-31 15:12 ` [patch 22/26] hwmon/lm87: Disable VID when it should be Greg KH
2007-10-31 15:12 ` [patch 23/26] hwmon/w83627hf: Fix setting fan min right after driver load Greg KH
2007-10-31 15:12 ` [patch 24/26] hwmon/w83627hf: Dont assume bank 0 Greg KH
2007-10-31 15:12 ` [patch 25/26] i915: fix vbl swap allocation size Greg KH
2007-10-31 15:12 ` [patch 26/26] POWERPC: Fix handling of stfiwx math emulation Greg KH
2007-10-31 15:21 ` [patch 00/26] 2.6.22-stable review Greg KH
2007-10-31 16:25 ` [patch 27/26] lockdep: fix mismatched lockdep_depth/curr_chain_hash Greg KH
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20071031151121.GH2437@kroah.com \
--to=gregkh@suse.de \
--cc=adobriyan@gmail.com \
--cc=akpm@linux-foundation.org \
--cc=alan@lxorguk.ukuu.org.uk \
--cc=bunk@kernel.org \
--cc=cavokz@gmail.com \
--cc=cebbert@redhat.com \
--cc=chuckw@quantumlinux.com \
--cc=davej@redhat.com \
--cc=davem@davemloft.net \
--cc=jmforbes@linuxtx.org \
--cc=linux-kernel@vger.kernel.org \
--cc=mkrufky@linuxtv.org \
--cc=rdunlap@xenotime.net \
--cc=reviews@ml.cw.f00f.org \
--cc=stable@kernel.org \
--cc=torvalds@linux-foundation.org \
--cc=tytso@mit.edu \
--cc=zwane@arm.linux.org.uk \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.