Attachment 308923 Details for Bug 450786 – Experimental patch for 2.6.18-92.el5 with instrumentation

[patch] Experimental patch for 2.6.18-92.el5 with instrumentation

linux-2.6-usb-usbdev_read-null-pointer-dereference.patch (text/plain), 2.27 KB, created by Robert N. Evans on 2008-06-11 13:06:42 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Robert N. Evans

Created: 2008-06-11 13:06:42 UTC

Size: 2.27 KB

patch

obsolete

>diff -Naur linux-2.6.18.x86_64.orig/drivers/usb/core/devio.c linux-2.6.18.x86_64/drivers/usb/core/devio.c
>--- linux-2.6.18.x86_64.orig/drivers/usb/core/devio.c	2008-06-10 18:24:11.000000000 +0000
>+++ linux-2.6.18.x86_64/drivers/usb/core/devio.c	2008-06-10 20:29:55.000000000 +0000
>@@ -557,6 +557,12 @@
> 		dev = usbdev_lookup_minor(iminor(inode));
> 	if (!dev)
> 		dev = inode->i_private;
>+	if (unlikely(!dev->usbdev_registered)) {
>+		dev = NULL;
>+		printk("BUG: warning usbdev_registered at %s:%d/%s()\n",
>+		       __FILE__, __LINE__, __FUNCTION__);
>+		dump_stack();
>+	}
> 	if (!dev) {
> 		kfree(ps);
> 		goto out;
>@@ -1588,10 +1594,12 @@
> 				"usbdev%d.%d", dev->bus->busnum, dev->devnum);
> 
> 	dev->class_dev->class_data = dev;
>+	dev->usbdev_registered = 1;
> }
> 
> static void usbdev_remove(struct usb_device *dev)
> {
>+	dev->usbdev_registered = 0;
> 	class_device_unregister(dev->class_dev);
> }
> 
>diff -Naur linux-2.6.18.x86_64.orig/drivers/usb/core/inode.c linux-2.6.18.x86_64/drivers/usb/core/inode.c
>--- linux-2.6.18.x86_64.orig/drivers/usb/core/inode.c	2008-06-10 18:24:04.000000000 +0000
>+++ linux-2.6.18.x86_64/drivers/usb/core/inode.c	2008-06-10 20:12:48.000000000 +0000
>@@ -665,8 +665,10 @@
> 					    devuid, devgid);
> 	if (dev->usbfs_dentry == NULL) {
> 		err ("error creating usbfs device entry");
>+		dev->usbdev_registered = 0;
> 		return;
> 	}
>+	dev->usbdev_registered = 1;
> 
> 	/* Set the size of the device's file to be
> 	 * equal to the size of the device descriptors. */
>@@ -701,6 +703,7 @@
> 			kill_proc_info_as_uid(ds->discsignr, &sinfo, ds->disc_pid, ds->disc_uid, ds->disc_euid, ds->secid);
> 		}
> 	}
>+	dev->usbdev_registered = 0;
> }
> 
> static int usbfs_notify(struct notifier_block *self, unsigned long action, void *dev)
>diff -Naur linux-2.6.18.x86_64.orig/include/linux/usb.h linux-2.6.18.x86_64/include/linux/usb.h
>--- linux-2.6.18.x86_64.orig/include/linux/usb.h	2008-06-10 18:24:12.000000000 +0000
>+++ linux-2.6.18.x86_64/include/linux/usb.h	2008-06-10 20:37:35.000000000 +0000
>@@ -351,6 +351,7 @@
> 	unsigned short bus_mA;		/* Current available from the bus */
> 	u8 portnum;			/* Parent port number (origin 1) */
> 
>+	unsigned usbdev_registered:1;	/* whether the device node or usbfs entry exists */
> 	int have_langid;		/* whether string_langid is valid */
> 	int string_langid;		/* language ID for strings */
>

Actions: View | Diff

Attachments on bug 450786: 308923 | 309101 | 309120 | 309142 | 309305 | 309692 | 310292 | 312710 | 312722 | 313707 | 313771