Arend van Spriel db4efbbeb4 brcmfmac: obtain platform data upon module initialization ... The driver uses platform_driver_probe() to obtain platform data if any. However, that function is placed in the .init section so it must be called upon driver module initialization. The problem was reported by Fenguang Wu resulting in a kernel oops because the .init section was already freed. [ 48.966342] Switched to clocksource tsc [ 48.970002] kernel tried to execute NX-protected page - exploit attempt? (uid: 0) [ 48.970851] BUG: unable to handle kernel paging request at ffffffff82196446 [ 48.970957] IP: [<ffffffff82196446>] classes_init+0x26/0x26 [ 48.970957] PGD 1e76067 PUD 1e77063 PMD f388063 PTE 8000000002196163 [ 48.970957] Oops: 0011 [#1] [ 48.970957] CPU: 0 PID: 17 Comm: kworker/0:1 Not tainted 3.11.0-rc7-00444-gc52dd7f #23 [ 48.970957] Workqueue: events brcmf_driver_init [ 48.970957] task: ffff8800001d2000 ti: ffff8800001d4000 task.ti: ffff8800001d4000 [ 48.970957] RIP: 0010:[<ffffffff82196446>] [<ffffffff82196446>] classes_init+0x26/0x26 [ 48.970957] RSP: 0000:ffff8800001d5d40 EFLAGS: 00000286 [ 48.970957] RAX: 0000000000000001 RBX: ffffffff820c5620 RCX: 0000000000000000 [ 48.970957] RDX: 0000000000000001 RSI: ffffffff816f7380 RDI: ffffffff820c56c0 [ 48.970957] RBP: ffff8800001d5d50 R08: ffff8800001d2508 R09: 0000000000000002 [ 48.970957] R10: 0000000000000000 R11: 0001f7ce298c5620 R12: ffff8800001c76b0 [ 48.970957] R13: ffffffff81e91d40 R14: 0000000000000000 R15: ffff88000e0ce300 [ 48.970957] FS: 0000000000000000(0000) GS:ffffffff81e84000(0000) knlGS:0000000000000000 [ 48.970957] CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b [ 48.970957] CR2: ffffffff82196446 CR3: 0000000001e75000 CR4: 00000000000006b0 [ 48.970957] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 48.970957] DR3: 0000000000000000 DR6: 0000000000000000 DR7: 0000000000000000 [ 48.970957] Stack: [ 48.970957] ffffffff816f7df8 ffffffff820c5620 ffff8800001d5d60 ffffffff816eeec9 [ 48.970957] ffff8800001d5de0 ffffffff81073dc5 ffffffff81073d68 ffff8800001d5db8 [ 48.970957] 0000000000000086 ffffffff820c5620 ffffffff824f7fd0 0000000000000000 [ 48.970957] Call Trace: [ 48.970957] [<ffffffff816f7df8>] ? brcmf_sdio_init+0x18/0x70 [ 48.970957] [<ffffffff816eeec9>] brcmf_driver_init+0x9/0x10 [ 48.970957] [<ffffffff81073dc5>] process_one_work+0x1d5/0x480 [ 48.970957] [<ffffffff81073d68>] ? process_one_work+0x178/0x480 [ 48.970957] [<ffffffff81074188>] worker_thread+0x118/0x3a0 [ 48.970957] [<ffffffff81074070>] ? process_one_work+0x480/0x480 [ 48.970957] [<ffffffff8107aa17>] kthread+0xe7/0xf0 [ 48.970957] [<ffffffff810829f7>] ? finish_task_switch.constprop.57+0x37/0xd0 [ 48.970957] [<ffffffff8107a930>] ? __kthread_parkme+0x80/0x80 [ 48.970957] [<ffffffff81a6923a>] ret_from_fork+0x7a/0xb0 [ 48.970957] [<ffffffff8107a930>] ? __kthread_parkme+0x80/0x80 [ 48.970957] Code: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc <cc> cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc [ 48.970957] RIP [<ffffffff82196446>] classes_init+0x26/0x26 [ 48.970957] RSP <ffff8800001d5d40> [ 48.970957] CR2: ffffffff82196446 [ 48.970957] ---[ end trace 62980817cd525f14 ]--- Cc: <stable@vger.kernel.org> # 3.10.x, 3.11.x Reported-by: Fengguang Wu <fengguang.wu@intel.com> Reviewed-by: Hante Meuleman <meuleman@broadcom.com> Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com> Tested-by: Fengguang Wu <fengguang.wu@intel.com> Signed-off-by: Arend van Spriel <arend@broadcom.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>		2013-09-26 14:02:33 -04:00
..
appletalk	PTR_RET is now PTR_ERR_OR_ZERO(): Replace most.	2013-07-15 11:25:01 +09:30
arcnet	arcnet: cleanup sizeof parameter	2013-07-19 17:36:03 -07:00
bonding	bonding: Make alb learning packet interval configurable	2013-09-15 22:20:44 -04:00
caif	caif: add a sanity check to the tty name	2013-09-04 00:27:27 -04:00
can	can: mscan: improve clock API use	2013-08-29 22:49:35 +02:00
cris
dsa
ethernet	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2013-09-19 13:57:28 -05:00
fddi	drivers:net: Convert dma_alloc_coherent(...__GFP_ZERO) to dma_zalloc_coherent	2013-08-29 21:55:23 -04:00
hamradio
hippi
hyperv	Drivers: hv: remove HV_DRV_VERSION	2013-08-02 11:34:30 +08:00
ieee802154	drivers/net/ieee802154: don't use devm_pinctrl_get_select_default() in probe	2013-07-11 17:18:27 -07:00
irda	net/irda/mcs7780: fix memory leaks in mcs_net_open()	2013-09-12 23:43:56 -04:00
phy	drivers: net: phy: cicada.c: clears warning Use #include <linux/io.h> instead of <asm/io.h>	2013-09-17 19:07:00 -04:00
plip
ppp	ip: generate unique IP identificator if local fragmentation is allowed	2013-09-19 14:11:15 -04:00
slip
team	net: team: inherit addr_assign_type along with dev_addr	2013-09-03 20:57:49 -04:00
usb	net: usb: cdc_ether: use usb.h macros whenever possible	2013-09-16 21:38:00 -04:00
vmxnet3	VMXNET3: Add support for virtual IOMMU	2013-08-27 16:02:02 -04:00
wan	net: wan: sbni: Fix incorrect placement of __initdata	2013-08-09 13:24:26 -07:00
wimax
wireless	brcmfmac: obtain platform data upon module initialization	2013-09-26 14:02:33 -04:00
xen-netback	xen-netback: Don't destroy the netdev until the vif is shut down	2013-09-19 14:03:51 -04:00
dummy.c	dummy: fix oops when loading the dummy failed	2013-07-11 11:59:20 -07:00
eql.c
ifb.c	ifb: fix oops when loading the ifb failed	2013-07-11 12:00:05 -07:00
Kconfig	packet: nlmon: virtual netlink monitoring device for packet sockets	2013-06-24 16:39:05 -07:00
LICENSE.SRC
loopback.c	net loopback: Set loopback_dev to NULL when freed	2013-09-17 19:05:13 -04:00
macvlan.c	macvlan: Move skb_clone check closer to call	2013-09-11 16:03:12 -04:00
macvtap.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2013-08-26 16:37:08 -04:00
Makefile	packet: nlmon: virtual netlink monitoring device for packet sockets	2013-06-24 16:39:05 -07:00
mdio.c
mii.c
netconsole.c	netconsole: fix a deadlock with rtnl and netconsole's mutex	2013-09-19 14:15:53 -04:00
nlmon.c	nlmon: use standard rtnetlink link api for add/del devices	2013-07-02 12:53:17 -07:00
ntb_netdev.c
rionet.c	rapidio/rionet: rework driver initialization and removal	2013-07-03 16:08:04 -07:00
sb1000.c
Space.c
sungem_phy.c
tun.c	tuntap: correctly handle error in tun_set_iff()	2013-09-12 17:21:42 -04:00
veth.c	veth: add vlan features	2013-07-19 17:36:03 -07:00
virtio_net.c	virtio-net: Set RXCSUM feature if GUEST_CSUM is available	2013-09-03 21:36:41 -04:00
vxlan.c	vxlan: Avoid creating fdb entry with NULL destination	2013-09-17 20:19:18 -04:00
xen-netfront.c	xen-netfront: pull on receive skb may need to happen earlier	2013-07-17 12:51:19 -07:00