All of lore.kernel.org
 help / color / mirror / Atom feed
From: Greg KH <gregkh@suse.de>
To: linux-kernel@vger.kernel.org, stable@kernel.org
Cc: stable-review@kernel.org, torvalds@linux-foundation.org,
	akpm@linux-foundation.org, alan@lxorguk.ukuu.org.uk,
	Luca Tettamanti <kronos.it@gmail.com>,
	Chris Snook <chris.snook@gmail.com>,
	"David S. Miller" <davem@davemloft.net>
Subject: [08/17] atl1: fix resume
Date: Fri, 22 Oct 2010 11:39:33 -0700	[thread overview]
Message-ID: <20101022184033.209913125@clark.site> (raw)
In-Reply-To: <20101022184048.GA25391@kroah.com>

2.6.27-stable review patch.  If anyone has any objections, please let us know.

------------------

From: Luca Tettamanti <kronos.it@gmail.com>

commit ec5a32f67c603b11d68eb283d94eb89a4f6cfce1 upstream.

adapter->cmb.cmb is initialized when the device is opened and freed when
it's closed. Accessing it unconditionally during resume results either
in a crash (NULL pointer dereference, when the interface has not been
opened yet) or data corruption (when the interface has been used and
brought down adapter->cmb.cmb points to a deallocated memory area).

Signed-off-by: Luca Tettamanti <kronos.it@gmail.com>
Acked-by: Chris Snook <chris.snook@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

---
 drivers/net/atlx/atl1.c |    5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

--- a/drivers/net/atlx/atl1.c
+++ b/drivers/net/atlx/atl1.c
@@ -2881,10 +2881,11 @@ static int atl1_resume(struct pci_dev *p
 	pci_enable_wake(pdev, PCI_D3cold, 0);
 
 	atl1_reset_hw(&adapter->hw);
-	adapter->cmb.cmb->int_stats = 0;
 
-	if (netif_running(netdev))
+	if (netif_running(netdev)) {
+		adapter->cmb.cmb->int_stats = 0;
 		atl1_up(adapter);
+	}
 	netif_device_attach(netdev);
 
 	return 0;



  parent reply	other threads:[~2010-10-22 18:43 UTC|newest]

Thread overview: 23+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2010-10-22 18:40 [00/17] 2.6.27.55-stable review Greg KH
2010-10-22 18:39 ` [01/17] aio: check for multiplication overflow in do_io_submit Greg KH
2010-10-22 18:39 ` [02/17] guard page for stacks that grow upwards Greg KH
2010-10-22 18:39 ` [03/17] ALSA: sound/pci/rme9652: prevent reading uninitialized stack memory Greg KH
2010-10-22 18:39 ` [04/17] ALSA: prevent heap corruption in snd_ctl_new() Greg KH
2010-10-22 18:39 ` [05/17] v4l1: fix 32-bit compat microcode loading translation Greg KH
2010-10-22 18:39 ` [06/17] dmaengine: fix interrupt clearing for mv_xor Greg KH
2010-10-22 18:39 ` [07/17] wext: fix potential private ioctl memory content leak Greg KH
2010-10-22 18:39 ` Greg KH [this message]
2010-10-22 18:39 ` [09/17] [SCSI] bsg: fix incorrect device_status value Greg KH
2010-10-22 18:39 ` [10/17] r6040: fix r6040_multicast_list Greg KH
2010-10-22 18:39 ` [11/17] r6040: Fix multicast list iteration when hash filter is used Greg KH
2010-10-22 19:13   ` Jack Stone
2010-10-22 19:23     ` Greg KH
2010-10-22 19:29       ` Jack Stone
2010-10-22 21:18         ` Ben Hutchings
2010-10-22 21:23           ` Jack Stone
2010-10-22 18:39 ` [12/17] powerpc: Initialise paca->kstack before early_setup_secondary Greg KH
2010-10-22 18:39 ` [13/17] powerpc: Dont use kernel stack with translation off Greg KH
2010-10-22 18:39 ` [14/17] b44: fix carrier detection on bind Greg KH
2010-10-22 18:39 ` [15/17] setup_arg_pages: diagnose excessive argument size Greg KH
2010-10-22 18:39 ` [16/17] execve: improve interactivity with large arguments Greg KH
2010-10-22 18:39 ` [17/17] execve: make responsive to SIGKILL " Greg KH

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20101022184033.209913125@clark.site \
    --to=gregkh@suse.de \
    --cc=akpm@linux-foundation.org \
    --cc=alan@lxorguk.ukuu.org.uk \
    --cc=chris.snook@gmail.com \
    --cc=davem@davemloft.net \
    --cc=kronos.it@gmail.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=stable-review@kernel.org \
    --cc=stable@kernel.org \
    --cc=torvalds@linux-foundation.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.