linux-toradex.git/drivers/net/usb/hso.c, branch v3.2.48

hso: fix a use after free condition

2011-07-08T16:07:59+00:00

This needs to go to netdev:

From: Octavian Purdila 

In hso_free_net_device hso_net pointer is freed and then used to
cleanup urb pools. Catched with SLAB_DEBUG during S3 resume:

[   95.824442] Pid: 389, comm: khubd Tainted: G         C  2.6.36greenridge-01400-g423cf13-dirty #154 Type2 - Board Product Name1/OakTrail
[   95.824442] EIP: 0060:[] EFLAGS: 00010202 CPU: 0
[   95.824442] EIP is at kref_put+0x29/0x42
[   95.824442] EAX: 6b6b6b6b EBX: 6b6b6b6b ECX: c2806b40 EDX: 00000037
[   95.824442] ESI: c1258d56 EDI: edd3d128 EBP: ee8cde0c ESP: ee8cde04
[   95.824442]  DS: 007b ES: 007b FS: 00d8 GS: 0000 SS: 0068
[   95.824442] Process khubd (pid: 389, ti=ee8cc000 task=ee95ed10 task.ti=ee8cc000)
[   95.824442] Stack:
[   95.824442]  edd07020 00000000 ee8cde14 c1258b77 ee8cde38 ef933a44 ef93572b ef935dec
[   95.824442] <0> 0000099a 6b6b6b6b 00000000 ee2da748 edd3e0c0 ee8cde54 ef933b9f ee3b53f8
[   95.824442] <0> 00000002 ee2da748 ee2da764 ef936658 ee8cde60 ef933d0c ee2da748 ee8cde84
[   95.824442] Call Trace:
[   95.824442]  [] ? usb_free_urb+0x11/0x13
[   95.824442]  [] ? hso_free_net_device+0x81/0xd8 [hso]
[   95.824442]  [] ? hso_free_interface+0x104/0x111 [hso]
[   95.824442]  [] ? hso_disconnect+0xb/0x18 [hso]
[   95.824442]  [] ? usb_unbind_interface+0x44/0x14a
[   95.824442]  [] ? __device_release_driver+0x6f/0xb1
[   95.824442]  [] ? device_release_driver+0x18/0x23
[   95.824442]  [] ? bus_remove_device+0x8a/0xa1
[   95.824442]  [] ? device_del+0x129/0x163
[   95.824442]  [] ? put_device+0xf/0x11
[   95.824442]  [] ? device_unregister+0x12/0x15
[   95.824442]  [] ? usb_disable_device+0x90/0xf0
[   95.824442]  [] ? usb_disconnect+0x6d/0xf8
[   95.824442]  [] ? hub_thread+0x3fc/0xc57
[   95.824442]  [] ? autoremove_wake_function+0x0/0x2f
[   95.824442]  [] ? complete+0x34/0x3e
[   95.824442]  [] ? hub_thread+0x0/0xc57
[   95.824442]  [] ? kthread+0x63/0x68
[   95.824442]  [] ? kthread+0x0/0x68
[   95.824442]  [] ? kernel_thread_helper+0x6/0x10

Signed-off-by: Octavian Purdila 
Signed-off-by: Alan Cox 
Signed-off-by: David S. Miller

Merge 2.6.38-rc6 into tty-next

2011-02-24T19:36:31+00:00

This was to resolve a merge issue with drivers/char/Makefile and
drivers/tty/serial/68328serial.c

Signed-off-by: Greg Kroah-Hartman

tty: now phase out the ioctl file pointer for good

2011-02-17T19:59:56+00:00

Only oddities here are a couple of drivers that bogusly called the ldisc
helpers instead of returning -ENOIOCTLCMD. Fix the bug and the rest goes
away.

Signed-off-by: Alan Cox 
Signed-off-by: Greg Kroah-Hartman

tiocmset: kill the file pointer argument

2011-02-17T19:52:43+00:00

Doing tiocmget was such fun we should do tiocmset as well for the same
reasons

Signed-off-by: Alan Cox 
Signed-off-by: Greg Kroah-Hartman

tiocmget: kill off the passing of the struct file

2011-02-17T19:47:33+00:00

We don't actually need this and it causes problems for internal use of
this functionality. Currently there is a single use of the FILE * pointer.
That is the serial core which uses it to check tty_hung_up_p. However if
that is true then IO_ERROR is also already set so the check may be removed.

Signed-off-by: Alan Cox 
Signed-off-by: Greg Kroah-Hartman

Net, USB, Option, hso: Do not dereference NULL pointer

2011-02-14T00:55:45+00:00

In drivers/net/usb/hso.c::hso_create_bulk_serial_device() we have this
code:
...
	serial = kzalloc(sizeof(*serial), GFP_KERNEL);
	if (!serial)
		goto exit;
...
exit:
	hso_free_tiomget(serial);
...
hso_free_tiomget() directly dereferences its argument, which in the
example above is a NULL pointer, ouch.
I could just add a 'if (serial)' test at the 'exit' label, but since most
freeing functions in the kernel accept NULL pointers (and it seems like
this was also assumed here) I opted to instead change 'hso_free_tiomget()'
so that it is safe to call it with a NULL argument. I also modified the
function to get rid of a pointles conditional before the call to
'usb_free_urb()' since that function already tests for NULL itself -
besides fixing the NULL deref this change also buys us a few bytes in
size.
Before:
$ size drivers/net/usb/hso.o
   text    data     bss     dec     hex filename
  32200     592    9960   42752    a700 drivers/net/usb/hso.o
After:
$ size drivers/net/usb/hso.o
   text    data     bss     dec     hex filename
  32196     592    9960   42748    a6fc drivers/net/usb/hso.o

Signed-off-by: Jesper Juhl 
Signed-off-by: David S. Miller

usb: Use static const, consolidate code

2010-12-21T10:16:09+00:00

Using static const generally increases object text and decreases data size.
It also generally decreases overall object size.

Consolidate duplicated code into new fix_crc_bug function
and declare data in that function static const.

Signed-off-by: Joe Perches

Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6

2010-12-17T20:27:22+00:00

Conflicts:
	drivers/net/bnx2x/bnx2x.h
	drivers/net/wireless/iwlwifi/iwl-1000.c
	drivers/net/wireless/iwlwifi/iwl-6000.c
	drivers/net/wireless/iwlwifi/iwl-core.h
	drivers/vhost/vhost.c

hso: IP checksuming doesn't work on GE0301 option cards

2010-12-10T04:42:24+00:00

There is definitly a problem, that some option cards send up broken
IP pakets leading to corrupted IP packets. These corruptions aren't
detected, because the driver claims that the packets are already
checksummed. This change removes the CHECKSUM_UNNECESSARY option
and let IP detect broken data.

Signed-off-by: Thomas Bogendoerfer 
Signed-off-by: David S. Miller

Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6

2010-12-08T21:47:38+00:00

Conflicts:
	drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
	net/llc/af_llc.c