Login
[x]
Log in using an account from:
Fedora Account System
Red Hat Associate
Red Hat Customer
Or login using a Red Hat Bugzilla account
Forgot Password
Login:
Hide Forgot
Create an Account
Red Hat Bugzilla – Attachment 310292 Details for
Bug 450786
[Stratus 5.3 bug] kernel NULL pointer dereference at usbdev_read
[?]
New
Simple Search
Advanced Search
My Links
Browse
Requests
Reports
Current State
Search
Tabular reports
Graphical reports
Duplicates
Other Reports
User Changes
Plotly Reports
Bug Status
Bug Severity
Non-Defaults
|
Product Dashboard
Help
Page Help!
Bug Writing Guidelines
What's new
Browser Support Policy
5.0.4.rh83 Release notes
FAQ
Guides index
User guide
Web Services
Contact
Legal
This site requires JavaScript to be enabled to function correctly, please enable it.
[patch]
Snapshot (same, one fix)
linux-2.6.18-81.el5-450786-snap1.diff (text/plain), 8.67 KB, created by
Pete Zaitcev
on 2008-06-25 19:50:55 UTC
(
hide
)
Description:
Snapshot (same, one fix)
Filename:
MIME Type:
Creator:
Pete Zaitcev
Created:
2008-06-25 19:50:55 UTC
Size:
8.67 KB
patch
obsolete
>Snapshot for my PTO on 6/25 2008. > >diff -urp -X dontdiff linux-2.6.18-81.el5/drivers/usb/core/devio.c linux-2.6.18-81.el5-u/drivers/usb/core/devio.c >--- linux-2.6.18-81.el5/drivers/usb/core/devio.c 2008-02-18 14:51:04.000000000 -0800 >+++ linux-2.6.18-81.el5-u/drivers/usb/core/devio.c 2008-06-20 22:53:13.000000000 -0700 >@@ -532,6 +532,8 @@ static struct usb_device *usbdev_lookup_ > } > up(&usb_device_class->sem); > >+ if (dev != NULL && dev->class_dev == NULL) >+ dev = NULL; > return dev; > }; > >@@ -555,7 +557,7 @@ static int usbdev_open(struct inode *ino > /* check if we are called from a real node or usbfs */ > if (imajor(inode) == USB_DEVICE_MAJOR) > dev = usbdev_lookup_minor(iminor(inode)); >- if (!dev) >+ if (!dev) /* Why this is not "else"? */ > dev = inode->i_private; > if (!dev) { > kfree(ps); >@@ -1579,20 +1581,48 @@ struct file_operations usbfs_device_file > .release = usbdev_release, > }; > >+void usb_fs_classdev_common_remove(struct usb_device *udev) >+{ >+ struct dev_state *ps; >+ struct siginfo sinfo; >+ >+ while (!list_empty(&udev->filelist)) { >+ ps = list_entry(udev->filelist.next, struct dev_state, list); >+ wake_up_all(&ps->wait); >+ list_del_init(&ps->list); >+ if (ps->discsignr) { >+ sinfo.si_signo = ps->discsignr; >+ sinfo.si_errno = EPIPE; >+ sinfo.si_code = SI_ASYNCIO; >+ sinfo.si_addr = ps->disccontext; >+ kill_proc_info_as_uid(ps->discsignr, &sinfo, >+ ps->disc_pid, ps->disc_uid, >+ ps->disc_euid, ps->secid); >+ } >+ } >+} >+ > static void usbdev_add(struct usb_device *dev) > { > int minor = ((dev->bus->busnum-1) * 128) + (dev->devnum-1); >+ struct class_device *cl_dev; > >- dev->class_dev = class_device_create(usb_device_class, NULL, >+ mutex_lock(&usbfs_mutex); >+ cl_dev = class_device_create(usb_device_class, NULL, > MKDEV(USB_DEVICE_MAJOR, minor), &dev->dev, > "usbdev%d.%d", dev->bus->busnum, dev->devnum); >- >- dev->class_dev->class_data = dev; >+ if (!IS_ERR(cl_dev)) { >+ cl_dev->class_data = dev; >+ dev->class_dev = cl_dev; >+ } >+ mutex_unlock(&usbfs_mutex); > } > > static void usbdev_remove(struct usb_device *dev) > { >- class_device_unregister(dev->class_dev); >+ if (dev->class_dev) >+ class_device_unregister(dev->class_dev); >+ usb_fs_classdev_common_remove(dev); > } > > static int usbdev_notify(struct notifier_block *self, unsigned long action, >diff -urp -X dontdiff linux-2.6.18-81.el5/drivers/usb/core/hcd.c linux-2.6.18-81.el5-u/drivers/usb/core/hcd.c >--- linux-2.6.18-81.el5/drivers/usb/core/hcd.c 2008-02-18 14:51:04.000000000 -0800 >+++ linux-2.6.18-81.el5-u/drivers/usb/core/hcd.c 2008-06-19 17:24:11.000000000 -0700 >@@ -105,6 +105,40 @@ static DEFINE_SPINLOCK(hcd_data_lock); > /* wait queue for synchronous unlinks */ > DECLARE_WAIT_QUEUE_HEAD(usb_kill_urb_queue); > >+/* dead driver used after rmmod xxxx_hcd */ >+static int dhci_urb_enqueue(struct usb_hcd *hcd, struct usb_host_endpoint *ep, >+ struct urb *urb, gfp_t mf) { >+ printk(KERN_WARNING "usb%d: dead enqueue\n", hcd->self.busnum); >+ return -ENODEV; >+} >+static int dhci_urb_dequeue(struct usb_hcd *hcd, struct urb *urb) { >+ printk(KERN_WARNING "usb%d: dead unlink\n", hcd->self.busnum); >+ return -ENODEV; >+} >+static void dhci_ep_disable(struct usb_hcd *hcd, struct usb_host_endpoint *ep) { >+ printk(KERN_WARNING "usb%d: dead ep disable\n", hcd->self.busnum); >+} >+static int dhci_get_frame(struct usb_hcd *hcd) { >+ return 0; >+} >+ >+static const struct hc_driver usb_dead_hc_driver = { >+ .description = "dead", >+ .product_desc = "DHCI", >+#if 0 /* defined(CONFIG_PM) */ >+ .pci_suspend = dhci_pci_suspend, >+ .pci_resume = dhci_pci_resume, >+#endif >+ .urb_enqueue = dhci_urb_enqueue, >+ .urb_dequeue = dhci_urb_dequeue, >+ .endpoint_disable = dhci_ep_disable, >+ .get_frame_number = dhci_get_frame, >+#if 0 /* defined(CONFIG_PM) */ >+ .bus_suspend = dhci_bus_suspend, >+ .bus_resume = dhci_bus_resume, >+#endif >+}; >+ > /*-------------------------------------------------------------------------*/ > > /* >@@ -1758,6 +1792,18 @@ void usb_put_hcd (struct usb_hcd *hcd) > } > EXPORT_SYMBOL (usb_put_hcd); > >+static ssize_t >+show_hcd_state(struct device *dev, struct device_attribute *attr, char *buf) >+{ >+ struct usb_hcd *hcd; >+ >+ hcd = dev_get_drvdata(dev); >+ if (hcd == NULL) >+ return 0; >+ return sprintf(buf, "%d\n", hcd->state); >+} >+static DEVICE_ATTR(hcd_state, S_IRUGO, show_hcd_state, NULL); >+ > /** > * usb_add_hcd - finish generic HCD structure initialization and register > * @hcd: the usb_hcd structure to initialize >@@ -1776,6 +1822,8 @@ int usb_add_hcd(struct usb_hcd *hcd, > > dev_info(hcd->self.controller, "%s\n", hcd->product_desc); > >+ /* P3 */ device_create_file(hcd->self.controller, &dev_attr_hcd_state); >+ > set_bit(HCD_FLAG_HW_ACCESSIBLE, &hcd->flags); > > /* HC is in reset state, but accessible. Now do the one-time init, >@@ -1903,10 +1951,19 @@ void usb_remove_hcd(struct usb_hcd *hcd) > hcd->driver->stop(hcd); > hcd->state = HC_STATE_HALT; > >+ { >+ if (hcd->self.controller == NULL) { >+ printk(KERN_ERR "NULL self controller\n"); >+ } else { >+ /* P3 */ device_remove_file(hcd->self.controller, &dev_attr_hcd_state); >+ } >+ } >+ > if (hcd->irq >= 0) > free_irq(hcd->irq, hcd); > usb_deregister_bus(&hcd->self); > hcd_buffer_destroy(hcd); >+ hcd->driver = &usb_dead_hc_driver; > } > EXPORT_SYMBOL (usb_remove_hcd); > >diff -urp -X dontdiff linux-2.6.18-81.el5/drivers/usb/core/hcd-pci.c linux-2.6.18-81.el5-u/drivers/usb/core/hcd-pci.c >--- linux-2.6.18-81.el5/drivers/usb/core/hcd-pci.c 2006-09-19 20:42:06.000000000 -0700 >+++ linux-2.6.18-81.el5-u/drivers/usb/core/hcd-pci.c 2008-06-19 17:03:46.000000000 -0700 >@@ -164,13 +164,15 @@ EXPORT_SYMBOL (usb_hcd_pci_probe); > void usb_hcd_pci_remove (struct pci_dev *dev) > { > struct usb_hcd *hcd; >+ int driver_flags; > > hcd = pci_get_drvdata(dev); > if (!hcd) > return; > >+ driver_flags = hcd->driver->flags; > usb_remove_hcd (hcd); >- if (hcd->driver->flags & HCD_MEMORY) { >+ if (driver_flags & HCD_MEMORY) { > iounmap (hcd->regs); > release_mem_region (hcd->rsrc_start, hcd->rsrc_len); > } else { >diff -urp -X dontdiff linux-2.6.18-81.el5/drivers/usb/core/hub.c linux-2.6.18-81.el5-u/drivers/usb/core/hub.c >--- linux-2.6.18-81.el5/drivers/usb/core/hub.c 2006-09-19 20:42:06.000000000 -0700 >+++ linux-2.6.18-81.el5-u/drivers/usb/core/hub.c 2008-06-19 19:23:28.000000000 -0700 >@@ -1244,7 +1244,7 @@ static int choose_configuration(struct u > && desc->bInterfaceClass == USB_CLASS_COMM > && desc->bInterfaceSubClass == 2 > && desc->bInterfaceProtocol == 0xff) { >-#ifndef CONFIG_USB_NET_RNDIS_HOST >+#if !defined(CONFIG_USB_NET_RNDIS_HOST) && !defined(CONFIG_USB_NET_RNDIS_HOST_MODULE) > continue; > #else > best = c; >diff -urp -X dontdiff linux-2.6.18-81.el5/drivers/usb/core/inode.c linux-2.6.18-81.el5-u/drivers/usb/core/inode.c >--- linux-2.6.18-81.el5/drivers/usb/core/inode.c 2008-02-18 14:50:57.000000000 -0800 >+++ linux-2.6.18-81.el5-u/drivers/usb/core/inode.c 2008-06-19 15:49:21.000000000 -0700 >@@ -682,25 +682,11 @@ static void usbfs_add_device(struct usb_ > > static void usbfs_remove_device(struct usb_device *dev) > { >- struct dev_state *ds; >- struct siginfo sinfo; >- > if (dev->usbfs_dentry) { > fs_remove_file (dev->usbfs_dentry); > dev->usbfs_dentry = NULL; > } >- while (!list_empty(&dev->filelist)) { >- ds = list_entry(dev->filelist.next, struct dev_state, list); >- wake_up_all(&ds->wait); >- list_del_init(&ds->list); >- if (ds->discsignr) { >- sinfo.si_signo = ds->discsignr; >- sinfo.si_errno = EPIPE; >- sinfo.si_code = SI_ASYNCIO; >- sinfo.si_addr = ds->disccontext; >- kill_proc_info_as_uid(ds->discsignr, &sinfo, ds->disc_pid, ds->disc_uid, ds->disc_euid, ds->secid); >- } >- } >+ usb_fs_classdev_common_remove(dev); > } > > static int usbfs_notify(struct notifier_block *self, unsigned long action, void *dev) >diff -urp -X dontdiff linux-2.6.18-81.el5/drivers/usb/core/usb.h linux-2.6.18-81.el5-u/drivers/usb/core/usb.h >--- linux-2.6.18-81.el5/drivers/usb/core/usb.h 2008-02-18 14:50:55.000000000 -0800 >+++ linux-2.6.18-81.el5-u/drivers/usb/core/usb.h 2008-06-19 14:37:21.000000000 -0700 >@@ -64,6 +64,7 @@ extern struct usb_driver usbfs_driver; > extern struct file_operations usbfs_devices_fops; > extern struct file_operations usbfs_device_file_operations; > extern void usbfs_conn_disc_event(void); >+extern void usb_fs_classdev_common_remove(struct usb_device *udev); > > extern int usbdev_init(void); > extern void usbdev_cleanup(void); >diff -urp -X dontdiff linux-2.6.18-81.el5/drivers/usb/host/ohci-q.c linux-2.6.18-81.el5-u/drivers/usb/host/ohci-q.c >--- linux-2.6.18-81.el5/drivers/usb/host/ohci-q.c 2006-09-19 20:42:06.000000000 -0700 >+++ linux-2.6.18-81.el5-u/drivers/usb/host/ohci-q.c 2008-06-19 16:56:09.000000000 -0700 >@@ -172,9 +172,6 @@ static int ed_schedule (struct ohci_hcd > { > int branch; > >- if (ohci_to_hcd(ohci)->state == HC_STATE_QUIESCING) >- return -EAGAIN; >- > ed->state = ED_OPER; > ed->ed_prev = NULL; > ed->ed_next = NULL;
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
Attachments on
bug 450786
:
308923
|
309101
|
309120
|
309142
|
309305
|
309692
| 310292 |
312710
|
312722
|
313707
|
313771