korg/linux
0
0
Fork 0
mirror of https://mirrors.bfsu.edu.cn/git/linux.git synced 2024-11-18 17:54:13 +08:00
Code Issues Packages Projects Releases Wiki Activity
f7410ced7f
linux/drivers
History
Herbert Xu f7410ced7f USB: Move hcd free_dev call into usb_disconnect to fix oops 
USB: Move hcd free_dev call into usb_disconnect

I found a way to oops the kernel:

1. Open a USB device through devio.
2. Remove the hcd module in the host kernel.
3. Close the devio file descriptor.

The problem is that closing the file descriptor does usb_release_dev
as it is the last reference.  usb_release_dev then tries to invoke
the hcd free_dev function (or rather dereferencing the hcd driver
struct).  This causes an oops as the hcd driver has already been
unloaded so the struct is gone.

This patch tries to fix this by bringing the free_dev call earlier
and into usb_disconnect.  I have verified that repeating the
above steps no longer crashes with this patch applied.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Cc: stable <stable@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2010-03-02 14:54:13 -08:00
..
accessibility
acpi Merge branch 'acpica' of git://git.kernel.org/pub/scm/linux/kernel/git/lenb/linux-acpi-2.6 2010-03-01 10:36:22 -08:00
amba
ata Merge branch 'upstream-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jgarzik/libata-dev 2010-03-01 13:04:58 -08:00
atm
auxdisplay
base PM: Allow device drivers to use dpm_wait() 2010-02-26 20:39:11 +01:00
block Merge branch 'for-2.6.34' of git://git.kernel.dk/linux-2.6-block 2010-03-01 09:00:29 -08:00
bluetooth Bluetooth: Fix memory leak in Marvell BT-over-SDIO driver 2010-02-03 19:08:30 -08:00
cdrom block: Consolidate phys_segment and hw_segment limits 2010-02-26 13:58:08 +01:00
char Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input 2010-03-01 10:38:09 -08:00
clocksource Merge branch 'timers-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip 2010-03-01 08:48:25 -08:00
connector connector: Delete buggy notification code. 2010-02-02 15:58:48 -08:00
cpufreq [CPUFREQ] Fix ondemand to not request targets outside policy limits 2010-01-13 10:55:16 -05:00
cpuidle
crypto Merge git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 2010-02-26 16:50:02 -08:00
dca
dio
dma Merge branch 'sh/stable-updates' 2010-02-15 14:49:37 +09:00
edac Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/bp/bp 2010-02-11 14:07:13 -08:00
eisa
firewire block: Rename blk_queue_max_sectors to blk_queue_max_hw_sectors 2010-02-26 13:58:08 +01:00
firmware drivers/firmware/iscsi_ibft.c: remove NIPQUAD_FMT, use %pI4 2010-02-26 21:02:14 +00:00
gpio
gpu Merge branch 'x86-pci-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip 2010-02-28 10:59:18 -08:00
hid Merge branches 'upstream', 'raw_report_modifications' and 'apple_magic_mouse' into for-linus 2010-02-25 17:39:16 +01:00
hwmon Merge commit 'origin/master' into next 2010-02-17 10:00:42 +11:00
i2c Merge branch 'for-linus' of master.kernel.org:/home/rmk/linux-2.6-arm 2010-03-01 09:15:15 -08:00
ide Merge branch 'acpica' of git://git.kernel.org/pub/scm/linux/kernel/git/lenb/linux-acpi-2.6 2010-03-01 10:36:22 -08:00
idle
ieee1394 block: Rename blk_queue_max_sectors to blk_queue_max_hw_sectors 2010-02-26 13:58:08 +01:00
ieee802154
infiniband Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/roland/infiniband 2010-02-11 14:01:25 -08:00
input Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input 2010-03-01 10:38:09 -08:00
isdn PCI: push deprecated pci_find_device() function to last user 2010-02-22 16:17:01 -08:00
leds
lguest
macintosh Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input 2010-03-01 10:38:09 -08:00
mca
md block: Consolidate phys_segment and hw_segment limits 2010-02-26 13:58:08 +01:00
media Merge branch 'v4l_for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-2.6 2010-02-26 17:16:20 -08:00
memstick block: Consolidate phys_segment and hw_segment limits 2010-02-26 13:58:08 +01:00
message Merge branch 'for-2.6.34' of git://git.kernel.dk/linux-2.6-block 2010-03-01 09:00:29 -08:00
mfd Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound-2.6 2010-03-01 08:58:44 -08:00
misc
mmc Merge branch 'for-linus' of master.kernel.org:/home/rmk/linux-2.6-arm 2010-03-01 09:15:15 -08:00
mtd MIPS: Alchemy: physmap-flash for all devboards 2010-02-27 12:52:59 +01:00
net Merge branch 'davinci-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/khilman/linux-davinci 2010-03-01 13:05:40 -08:00
nubus
of of: move definition of of_chosen into common code. 2010-02-14 07:13:55 -07:00
oprofile
parisc
parport
pci Merge branch 'acpica' of git://git.kernel.org/pub/scm/linux/kernel/git/lenb/linux-acpi-2.6 2010-03-01 10:36:22 -08:00
pcmcia Merge branch 'upstream' of git://ftp.linux-mips.org/pub/scm/upstream-linus 2010-02-27 16:19:22 -08:00
platform Merge branch 'acpica' of git://git.kernel.org/pub/scm/linux/kernel/git/lenb/linux-acpi-2.6 2010-03-01 10:36:22 -08:00
pnp
power wm97xx_battery: Handle missing platform data gracefully 2010-01-29 17:00:18 +03:00
pps
ps3 powerpc: Remove trailing space in messages 2010-02-09 13:56:23 +11:00
rapidio
regulator regulator/lp3971: vol_map out of bounds in lp3971_{ldo,dcdc}_set_voltage() 2010-02-12 11:39:49 +00:00
rtc Merge branch 'for-linus' of master.kernel.org:/home/rmk/linux-2.6-arm 2010-03-01 09:15:15 -08:00
s390 Merge branch 'for-2.6.34' of git://git.kernel.dk/linux-2.6-block 2010-03-01 09:00:29 -08:00
sbus Merge commit 'v2.6.33-rc5' into secretlab/test-devicetree 2010-01-28 14:38:25 -07:00
scsi Merge branch 'for-2.6.34' of git://git.kernel.dk/linux-2.6-block 2010-03-01 09:00:29 -08:00
serial Merge branch 'for-linus' of master.kernel.org:/home/rmk/linux-2.6-arm 2010-03-01 09:15:15 -08:00
sfi
sh sh: Use dummy_irq_chip for INTC redirect vectors. 2010-02-17 12:37:42 +09:00
sn
spi Merge branch 'for-linus' of master.kernel.org:/home/rmk/linux-2.6-arm 2010-03-01 09:15:15 -08:00
ssb ssb: Fix CONFIG_SSB_SDIOHOST typo 2010-02-03 16:55:20 -05:00
staging USB: rename USB_SPEED_VARIABLE to USB_SPEED_WIRELESS 2010-03-02 14:53:36 -08:00
tc
telephony
thermal
uio
usb USB: Move hcd free_dev call into usb_disconnect to fix oops 2010-03-02 14:54:13 -08:00
uwb
video Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/linux-m68k 2010-02-27 16:22:47 -08:00
virtio virtio: fix out of range array access 2010-02-28 20:39:11 +02:00
vlynq
w1
watchdog Merge branch 'for-linus' of master.kernel.org:/home/rmk/linux-2.6-arm 2010-03-01 09:15:15 -08:00
xen xen: fix hang on suspend. 2010-01-13 10:01:35 +00:00
zorro
Kconfig
Makefile