Greg KH
5e2cd0825a
hso: fix a use after free condition ...
This needs to go to netdev:
From: Octavian Purdila <octavian.purdila@intel.com>
In hso_free_net_device hso_net pointer is freed and then used to
cleanup urb pools. Catched with SLAB_DEBUG during S3 resume:
[ 95.824442] Pid: 389, comm: khubd Tainted: G C 2.6.36greenridge-01400-g423cf13-dirty #154 Type2 - Board Product Name1/OakTrail
[ 95.824442] EIP: 0060:[<c1151551>] EFLAGS: 00010202 CPU: 0
[ 95.824442] EIP is at kref_put+0x29/0x42
[ 95.824442] EAX: 6b6b6b6b EBX: 6b6b6b6b ECX: c2806b40 EDX: 00000037
[ 95.824442] ESI: c1258d56 EDI: edd3d128 EBP: ee8cde0c ESP: ee8cde04
[ 95.824442] DS: 007b ES: 007b FS: 00d8 GS: 0000 SS: 0068
[ 95.824442] Process khubd (pid: 389, ti=ee8cc000 task=ee95ed10 task.ti=ee8cc000)
[ 95.824442] Stack:
[ 95.824442] edd07020 00000000 ee8cde14 c1258b77 ee8cde38 ef933a44 ef93572b ef935dec
[ 95.824442] <0> 0000099a 6b6b6b6b 00000000 ee2da748 edd3e0c0 ee8cde54 ef933b9f ee3b53f8
[ 95.824442] <0> 00000002 ee2da748 ee2da764 ef936658 ee8cde60 ef933d0c ee2da748 ee8cde84
[ 95.824442] Call Trace:
[ 95.824442] [<c1258b77>] ? usb_free_urb+0x11/0x13
[ 95.824442] [<ef933a44>] ? hso_free_net_device+0x81/0xd8 [hso]
[ 95.824442] [<ef933b9f>] ? hso_free_interface+0x104/0x111 [hso]
[ 95.824442] [<ef933d0c>] ? hso_disconnect+0xb/0x18 [hso]
[ 95.824442] [<c125b7f1>] ? usb_unbind_interface+0x44/0x14a
[ 95.824442] [<c11e56e8>] ? __device_release_driver+0x6f/0xb1
[ 95.824442] [<c11e57c7>] ? device_release_driver+0x18/0x23
[ 95.824442] [<c11e4e92>] ? bus_remove_device+0x8a/0xa1
[ 95.824442] [<c11e3970>] ? device_del+0x129/0x163
[ 95.824442] [<c11e2dc0>] ? put_device+0xf/0x11
[ 95.824442] [<c11e39bc>] ? device_unregister+0x12/0x15
[ 95.824442] [<c125915f>] ? usb_disable_device+0x90/0xf0
[ 95.824442] [<c125544f>] ? usb_disconnect+0x6d/0xf8
[ 95.824442] [<c1255f91>] ? hub_thread+0x3fc/0xc57
[ 95.824442] [<c1048526>] ? autoremove_wake_function+0x0/0x2f
[ 95.824442] [<c102529d>] ? complete+0x34/0x3e
[ 95.824442] [<c1255b95>] ? hub_thread+0x0/0xc57
[ 95.824442] [<c10481fc>] ? kthread+0x63/0x68
[ 95.824442] [<c1048199>] ? kthread+0x0/0x68
[ 95.824442] [<c1002d76>] ? kernel_thread_helper+0x6/0x10
Signed-off-by: Octavian Purdila <octavian.purdila@intel.com>
Signed-off-by: Alan Cox <alan@linux.intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2011-07-08 09:07:59 -07:00
2011-05-29 11:19:16 -07:00
2011-05-26 10:33:34 +01:00
2011-06-29 10:10:07 -07:00
2011-06-28 11:15:36 -07:00
2011-05-26 17:12:32 -07:00
2011-06-30 10:10:50 +02:00
2011-06-17 12:40:36 -04:00
2011-06-02 05:29:19 +09:00
2011-06-15 20:04:02 -07:00
2011-05-31 15:26:42 +09:00
2011-06-07 12:02:00 -07:00
2011-06-16 16:31:13 -04:00
2011-05-29 11:18:09 -07:00
2011-06-30 07:43:27 +08:00
2011-06-14 15:03:07 +09:00
2011-05-26 17:12:37 -07:00
2011-06-28 11:15:36 -07:00
2011-07-05 23:17:08 -06:00
2011-07-02 09:08:56 -07:00
2011-06-24 13:41:11 +02:00
2011-07-03 11:12:06 -07:00
2011-06-29 11:36:11 +02:00
2011-06-11 15:06:48 -07:00
2011-07-04 15:53:28 -07:00
2011-07-05 10:38:43 +02:00
2011-06-17 15:27:32 -04:00
2011-06-27 18:00:13 -07:00
2011-05-23 09:12:26 -07:00
2011-06-28 16:59:42 +10:00
2011-07-06 12:16:49 -07:00
2011-05-23 09:12:26 -07:00
2011-07-05 10:39:38 +02:00
2011-06-28 11:15:36 -07:00
2011-06-25 18:53:05 -04:00
2011-06-22 06:08:48 -05:00
2011-07-08 09:07:59 -07:00
2011-05-25 00:08:17 +01:00
2011-05-31 16:33:34 +02:00
2011-05-26 13:19:00 -07:00
2011-06-27 14:55:43 -07:00
2011-06-16 08:40:44 -06:00
2011-05-29 11:44:33 -07:00
2011-05-27 10:12:35 -07:00
2011-06-01 19:29:10 -07:00
2011-05-27 10:49:30 +01:00
2011-06-27 18:00:12 -07:00
2011-06-06 14:14:56 +02:00
2011-07-03 14:26:24 -05:00
2011-06-14 15:15:25 +09:00
2011-06-17 08:27:27 -06:00
2011-06-03 14:19:49 -04:00
2011-07-06 12:16:49 -07:00
2011-06-24 00:09:16 +00:00
2011-07-04 15:54:18 -07:00
2011-07-01 14:20:39 -07:00
2011-05-30 11:14:15 +09:30
2011-07-04 16:02:48 +09:00
2011-05-30 11:14:16 +09:30
2011-06-15 20:04:00 -07:00
2011-06-28 20:01:25 +00:00
2011-06-20 09:01:33 -07:00
2011-05-23 13:01:00 -07:00
2011-05-28 12:35:15 -07:00
5e2cd0825a