linux-kernel - Re: linux-next: manual merge of the driver-core tree with the net-next tree

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20141204101915.GA9689@hudson.localdomain>
Date:	Thu, 4 Dec 2014 02:19:15 -0800
From:	Jeremiah Mahler <jmmahler@...il.com>
To:	Arend van Spriel <arend@...adcom.com>
Cc:	linux-kernel@...r.kernel.org
Subject: Re: linux-next: manual merge of the driver-core tree with the
 net-next tree

Arend,

I haven't heard if you have looked at this bug at all yet.  I was
curious so I looked at it some more and I have some more information
that might be helpful.

On Wed, Dec 03, 2014 at 01:41:28PM -0800, Jeremiah Mahler wrote:
> On Wed, Dec 03, 2014 at 01:06:59PM -0800, Jeremiah Mahler wrote:
> > Arend,
> > 
[...]
> > > >
> > > >I took a look at the patch that is causing this problem (d32394fae95).
> > > >My config negates everything in the patch except for a one line change
> > > >to ath9k/pci.c.  If I remove this change (shown below) the problem goes
> > > >away.
> > > 
> > > Ok. But then it will likely crash when you cat one of the changed debugfs
> > > files. Guess this commit needs to be reverted entirely.
> > > 
[...]

Referring to the code snippet below, notice that both pci_set_drvdata()
and dev_set_drvdata() are called.  If the call to dev_set_drvdata() is
removed the bug goes away.

  drivers/net/wireless/ath/ath9k/pci.c

  861     SET_IEEE80211_DEV(hw, &pdev->dev);
  862     pci_set_drvdata(pdev, hw);
  863
  864     sc = hw->priv;
  865     sc->hw = hw;
  866     sc->dev = &pdev->dev;
  867     dev_set_drvdata(sc->dev, sc);
  868     sc->mem = pcim_iomap_table(pdev)[0];
  869     sc->driver_data = id->driver_data;

Translating the call to pci_set_drvdata() produces the following.

  pci_set_drvdata(pdev, hw);
    (translating from include/linux/pci.h)
    dev_set_drvdata(&pdev->dev, hw)
      (translating from include/linux/device.h)
      &pdev->dev->driver = hw;

And doing the same for dev_set_drvdata().

  dev_set_drvdata(sc->dev, sc)
    (sc->dev = &pdev->dev)
    dev_set_drvdata(&pdev->dev, sc)
      (translating from include/linux/device.h)
      &pdev->dev->driver = sc;

The same destination is being set with two different values.  Then calls
to pci_get_drvdata(), which expect hw, are getting sc, and it breaks.

-- 
- Jeremiah Mahler
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/