netdev - Re: 3.0.8 kernel : NULL ptr deref in skb_queue

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CANEJEGvNePLb9KcMO-sGSN81y6mb_zaHHQVujSbJXcCwh3Xcmw@mail.gmail.com>
Date:	Thu, 8 Dec 2011 11:04:48 -0800
From:	Grant Grundler <grundler@...omium.org>
To:	Greg KH <greg@...ah.com>
Cc:	netdev@...r.kernel.org, linux-usb@...r.kernel.org
Subject: Re: 3.0.8 kernel : NULL ptr deref in skb_queue_purge()

On Thu, Dec 8, 2011 at 10:02 AM, Greg KH <greg@...ah.com> wrote:
> On Wed, Dec 07, 2011 at 02:40:49PM -0800, Grant Grundler wrote:
>> Hi,
>> I'm testing asix (USB 100BT ethernet adapter with AX88772) driver
>> initialization (and shut down) paths and reproduced a
>> "skb_queue_purge" panic 3 times after a few hundred/thousand
>> iterations of rmmod/modprobe. I'm inclined to believe
>> skb_queue_purge() is a victim and not a culprit here.
>>
>>  I don't know if all 3 "spontaneous reboots" I've seen have the same
>> stack trace as the one I have a record for:
>
> Have you tried this on 3.1, and especially, 3.2-rc?

Hi Greg,
I haven't tried any thing later yet.  I would consider it if someone
could point at a change(s) that might be relevant to the symptom.


>  A number of asix
> patches have gone into the 3.2-rc series, perhaps they might have
> resolved this problem already?

I'm the one who submitted those changes. :)

asix.c driver I'm testing was pulled directly from davem's net-next
tree and I believe that's what is in 3.2-rc series now.

Those changes only relate to AX88772 and AX88178 bind and reset code.
suspend/resume support is unchanged  - though I suspect ax*_reset
functions get called in resume.

It's possible this code path in asix.c has *always* been broken. I see
two drivesr/net/usbnet USB drivers that do this:

drivers/net/usb/cdc_ether.c  614 .reset_resume = usbnet_resume,
drivers/net/usb/cdc_ncm.c  1193 .reset_resume = usbnet_resume,

Even though most usbnet drivers don't,  I'm tempted to add this code
and "just try it":

diff --git a/drivers/net/usb/asix.c b/drivers/net/usb/asix.c
index e6fed4d..b2de65f 100644
--- a/drivers/net/usb/asix.c
+++ b/drivers/net/usb/asix.c
@@ -1666,6 +1666,7 @@ static struct usb_driver asix_driver = {
        .probe =        usbnet_probe,
        .suspend =      usbnet_suspend,
        .resume =       usbnet_resume,
+       .reset_resume = usbnet_reset_resume,
        .disconnect =   usbnet_disconnect,
        .supports_autosuspend = 1,
 };



thanks!
grant
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html