renegade-project/linux-next
2
0
Fork 0
mirror of https://github.com/edk2-porting/linux-next.git synced 2025-01-17 01:54:01 +08:00
Code
327d74f6b6
linux-next/drivers
History
Marcin Slusarz 327d74f6b6 USB: emi26: fix oops on load 
Fix oops introduced by commit ae93a55bf9
(emi26: use request_firmware()):

usb 1-1: new full speed USB device using uhci_hcd and address 2
usb 1-1: configuration #1 chosen from 1 choice
emi26 - firmware loader 1-1:1.0: emi26_probe start
usb 1-1: firmware: requesting emi26/loader.fw
usb 1-1: firmware: requesting emi26/bitstream.fw
usb 1-1: firmware: requesting emi26/firmware.fw
usb 1-1: emi26_set_reset - 1
usb 1-1: emi26_set_reset - 0
BUG: unable to handle kernel NULL pointer dereference at 00000000
IP: [<f80dc487>] emi26_probe+0x2f7/0x620 [emi26]
*pde = 00000000
Oops: 0000 [#1] SMP
last sysfs file: /sys/devices/pci0000:00/0000:00:1d.0/usb1/1-1/firmware/1-1/loading
Modules linked in: emi26(+) ipv6 cpufreq_ondemand coretemp arc4 ecb iwl3945 irtty_sir sir_dev nsc_ircc ehci_hcd uhci_hcd mac80211 irda usbcore snd_hda_intel thinkpad_acpi rfkill hwmon led_class e1000e snd_pcm cfg80211 snd_timer crc_ccitt snd snd_page_alloc aes_generic

Pid: 5082, comm: modprobe Not tainted (2.6.28 #2) 17023QG
EIP: 0060:[<f80dc487>] EFLAGS: 00010206 CPU: 0
EIP is at emi26_probe+0x2f7/0x620 [emi26]
EAX: 0000015c EBX: 00000000 ECX: c1ffd9c0 EDX: 00000000
ESI: 0000015c EDI: f6bb215c EBP: f6bb0400 ESP: f00ebcfc
 DS: 007b ES: 007b FS: 00d8 GS: 0033 SS: 0068
Process modprobe (pid: 5082, ti=f00ea000 task=f5c7c700 task.ti=f00ea000)
Stack:
 0000015c 000000a5 f6a67cb8 f80dc7e0 c01c6262 fbef2986 f6bb2000 00008fe0
 0000015c f715f748 f715f740 f715f738 f715f748 f6a67c00 f80dd040 f80dcfc0
 f6bb0400 fbacb290 f6a67c94 fbae0160 c01c70bf 00000000 f6a67c1c 00000000
Call Trace:
 [<c01c6262>] sysfs_add_one+0x12/0x50
 [<fbacb290>] usb_probe_interface+0xa0/0x140 [usbcore]
 [<c01c70bf>] sysfs_create_link+0xf/0x20
 [<c02dead2>] driver_probe_device+0x82/0x180
 [<fbac9eeb>] usb_match_id+0x3b/0x50 [usbcore]
 [<c02dec4e>] __driver_attach+0x7e/0x80
 [<c02de27a>] bus_for_each_dev+0x3a/0x60
 [<c02de956>] driver_attach+0x16/0x20
 [<c02debd0>] __driver_attach+0x0/0x80
 [<c02de7b1>] bus_add_driver+0x1a1/0x220
 [<c02dee4d>] driver_register+0x4d/0x120
 [<c024e622>] idr_get_empty_slot+0xf2/0x290
 [<fbacab71>] usb_register_driver+0x81/0x100 [usbcore]
 [<f806c000>] emi26_init+0x0/0x14 [emi26]
 [<c0101126>] do_one_initcall+0x36/0x1b0
 [<c01c5e70>] sysfs_ilookup_test+0x0/0x10
 [<c0197a61>] ifind+0x31/0x90
 [<c01c6229>] __sysfs_add_one+0x59/0x80
 [<c01c64e4>] sysfs_addrm_finish+0x14/0x1c0
 [<c0175ca3>] __vunmap+0xa3/0xd0
 [<c014b854>] load_module+0x1544/0x1640
 [<c014b9d7>] sys_init_module+0x87/0x1b0
 [<c0187f41>] sys_read+0x41/0x70
 [<c01032a5>] sysenter_do_call+0x12/0x21
 [<c03d0000>] wait_for_common+0x40/0x110
Code: 66 c1 e8 08 66 09 d0 75 a5 31 d2 89 e8 e8 72 fc ff ff 85 c0 0f 88 9a 02 00 00 b8 fa 00 00 00 e8 30 46 05 c8 8b 74 24 28 8b 5e 04 <8b> 03 89 44 24 1c 0f c8 89 44 24 1c 0f b7 4b 04 c7 44 24 20 00
EIP: [<f80dc487>] emi26_probe+0x2f7/0x620 [emi26] SS:ESP 0068:f00ebcfc
---[ end trace 2eefa13825431230 ]---

After the last "package" of firmware data is sent to the device, we dereference
NULL pointer (on access to rec->addr). Fix it.

Reported--by: David Flatz <david@upcs.at>
Tested-by: David Flatz <david@upcs.at>
Signed-off-by: Marcin Slusarz <marcin.slusarz@gmail.com>
Cc: David Woodhouse <dwmw2@infradead.org>
Cc: stable <stable@kernel.org> [2.6.27, 2.6.28]
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2009-01-07 10:00:13 -08:00
..
accessibility
acpi remove linux/hardirq.h from asm-generic/local.h 2009-01-06 15:59:13 -08:00
amba
ata libata: struct device - replace bus_id with dev_name(), dev_set_name() 2009-01-06 10:44:43 -08:00
atm
auxdisplay
base Merge git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core-2.6 2009-01-06 17:02:07 -08:00
block USB: change interface to usb_lock_device_for_reset() 2009-01-07 09:59:52 -08:00
bluetooth
cdrom
char Merge git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core-2.6 2009-01-06 17:02:07 -08:00
clocksource Merge branch 'cpus4096-for-linus-2' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip 2009-01-02 11:44:09 -08:00
connector
cpufreq
cpuidle
crypto
dca
dio
dma
edac edac: driver for i5400 MCH (update) 2009-01-06 15:59:30 -08:00
eisa
firewire
firmware Merge git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core-2.6 2009-01-06 17:02:07 -08:00
gpio Merge git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core-2.6 2009-01-06 17:02:07 -08:00
gpu drm: fix ordering of driver unload vs agp unload. 2009-01-07 11:54:57 +10:00
hid USB: change interface to usb_lock_device_for_reset() 2009-01-07 09:59:52 -08:00
hwmon Merge git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core-2.6 2009-01-06 17:02:07 -08:00
i2c USB: move isp1301_omap to drivers/usb/otg 2009-01-07 10:00:02 -08:00
ide scc_pata: make use of scc_dma_sff_read_status() 2009-01-06 17:21:02 +01:00
idle i7300_idle: struct device - replace bus_id with dev_name(), dev_set_name() 2009-01-06 10:44:39 -08:00
ieee1394
infiniband infiniband: struct device - replace bus_id with dev_name(), dev_set_name() 2009-01-06 10:44:39 -08:00
input Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input 2009-01-06 17:14:01 -08:00
isdn ISDN: struct device - replace bus_id with dev_name(), dev_set_name() 2009-01-06 10:44:39 -08:00
leds
lguest lguest: do not statically allocate root device 2009-01-06 10:44:34 -08:00
macintosh Merge git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core-2.6 2009-01-06 17:02:07 -08:00
mca
md dm snapshot: extend exception store functions 2009-01-06 03:05:19 +00:00
media USB: change interface to usb_lock_device_for_reset() 2009-01-07 09:59:52 -08:00
memstick memstick: struct device - replace bus_id with dev_name(), dev_set_name() 2009-01-06 10:44:38 -08:00
message Merge git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core-2.6 2009-01-06 17:02:07 -08:00
mfd mfd: Fix section mismatch in da903x 2009-01-04 15:31:49 +01:00
misc Merge git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core-2.6 2009-01-06 17:02:07 -08:00
mmc Merge branch 'master' of ../mmc 2008-12-31 19:56:05 +01:00
mtd mtd: struct device - replace bus_id with dev_name(), dev_set_name() 2009-01-06 10:44:38 -08:00
net USB: avoid needless address-taking of function parameters 2009-01-07 09:59:50 -08:00
nubus
of
oprofile zero i_uid/i_gid on inode allocation 2009-01-05 11:54:28 -05:00
parisc Merge branch 'cpus4096-for-linus-2' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip 2009-01-02 11:44:09 -08:00
parport parport: ieee1284: use del_timer_sync() in parport_wait_event() 2009-01-06 15:59:31 -08:00
pci PCI: Rework default handling of suspend and resume 2009-01-06 10:44:32 -08:00
pcmcia
pnp pnp: struct device - replace bus_id with dev_name(), dev_set_name() 2009-01-06 10:44:38 -08:00
power power-supply: struct device - replace bus_id with dev_name(), dev_set_name() 2009-01-06 10:44:38 -08:00
ps3
rapidio rapidio: remove excess kernel-doc notation 2009-01-06 15:59:28 -08:00
regulator mfd: Support configurable numbers of DCDCs and ISINKs on WM8350 2009-01-04 12:17:42 +01:00
rtc drivers/rtc: correct an error test 2009-01-06 15:59:25 -08:00
s390 s390: remove s390_root_dev_*() 2009-01-06 10:44:34 -08:00
sbus
scsi remove ide-scsi 2009-01-02 16:12:51 +01:00
serial serial: struct device - replace bus_id with dev_name(), dev_set_name() 2009-01-06 10:44:37 -08:00
sh
sn
spi Merge git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core-2.6 2009-01-06 17:02:07 -08:00
ssb
staging Staging: android: binder: fix build errors 2009-01-06 13:52:46 -08:00
tc
telephony
thermal thermal: struct device - replace bus_id with dev_name(), dev_set_name() 2009-01-06 10:44:37 -08:00
uio UIO: Pass information about ioports to userspace (V2) 2009-01-06 10:44:44 -08:00
usb USB: emi26: fix oops on load 2009-01-07 10:00:13 -08:00
uwb Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux-2.6 into for-upstream 2009-01-02 13:17:13 +00:00
video Merge git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core-2.6 2009-01-06 17:02:07 -08:00
virtio virtio: do not statically allocate root device 2009-01-06 10:44:34 -08:00
w1 w1: struct device - replace bus_id with dev_name(), dev_set_name() 2009-01-06 10:44:34 -08:00
watchdog [WATCHDOG] Add support for the WM8350 watchdog 2008-12-31 16:12:54 +00:00
xen xen: struct device - replace bus_id with dev_name(), dev_set_name() 2009-01-06 10:44:34 -08:00
zorro
Kconfig
Makefile USB: move isp1301_omap to drivers/usb/otg 2009-01-07 10:00:02 -08:00