Re: tty_register_device NULL pointer dereference in 2.6.31-rc4

[Oliver Hartkopp <oliver@hartkopp.net>]

[-- Attachment #1: Type: text/plain, Size: 1607 bytes --]

Dave Young wrote:
> On Mon, Jul 27, 2009 at 01:39:03PM +0200, Oliver Hartkopp wrote:
>> Oliver Hartkopp wrote:
>>> Dave Young wrote:
>>>> On Sat, Jul 25, 2009 at 01:10:46PM +0100, Alan Cox wrote:
>>>>>>> tty_register_device appears to have been called with a NULL pointer. Not
>>>>>>> sure why however.
>>>>>> if that is the pointer for the struct device, then that used to be fine
>>>>>> in the past. Not all RFCOMM device have a parent when they are created.
>>>>> The tty layer doesn't care about the struct device really. Nothing there
>>>>> has changed. The NULL passed appears to be the driver argument.
>>>> Agree with you, because in rfcomm_init, rfcomm thread run before tty initilized, the following patch may fix the problem.
>>>> oliver, could you verify it it fix your problem?
>>> Hi Dave,
>>>
>>> i get this problem really seldom on my Laptop and i did not manage to get a
>>> reproducible Oops of that problem.
>>>
>>> Anyway the code you are pointing to seems to have a problem and your added
>>> error handling looks good to me - even if i don't know if the initializations
>>> can be reordered in that way.
>>>
>>> I'll try your patch, but it could take a *long* time to prove it right ;-)
>>>
>> Just FYI:
>>
>> Your patch compiled, the system booted without problems and nothing is broken
>> so far. I checked the BT, WLAN and BT dial-up with success. So it looks good
>> to me.
> 
> Thanks for the testing. Marcel, could you take a look? 

Hi Dave,

i got it again - even with your patch (that's why it's 2.6.31-rc4-dirty in the
attached screenshot).

Sorry ;-)

Best regards,
Oliver


[-- Attachment #2: tty_register_device_2-6-31-rc4-patched-by-dave.jpg --]
[-- Type: image/jpeg, Size: 127030 bytes --]