From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <linux-kernel-owner@vger.kernel.org>
Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
        id S1754256AbdJSVwA (ORCPT <rfc822;w@1wt.eu>);
        Thu, 19 Oct 2017 17:52:00 -0400
Received: from lb2-smtp-cloud8.xs4all.net ([194.109.24.25]:57612 "EHLO
        lb2-smtp-cloud8.xs4all.net" rhost-flags-OK-OK-OK-OK)
        by vger.kernel.org with ESMTP id S1754114AbdJSVvv (ORCPT
        <rfc822;linux-kernel@vger.kernel.org>);
        Thu, 19 Oct 2017 17:51:51 -0400
Message-ID: <1508449907.2274.28.camel@tiscali.nl>
Subject: Re: [PATCH 32/58] isdn/gigaset: Convert timers to use timer_setup()
From: Paul Bolle <pebolle@tiscali.nl>
To: Thomas Gleixner <tglx@linutronix.de>
Cc: Kees Cook <keescook@chromium.org>,
        "David S. Miller" <davem@davemloft.net>,
        Karsten Keil <isdn@linux-pingi.de>, Johan Hovold <johan@kernel.org>,
        gigaset307x-common@lists.sourceforge.net, netdev@vger.kernel.org,
        linux-kernel@vger.kernel.org
Date: Thu, 19 Oct 2017 23:51:47 +0200
In-Reply-To: <alpine.DEB.2.20.1710192328110.2054@nanos>
References: <1508200182-104605-1-git-send-email-keescook@chromium.org>
                 <1508200182-104605-33-git-send-email-keescook@chromium.org>
                 <1508447002.2274.14.camel@tiscali.nl>
         <1508448028.2274.21.camel@tiscali.nl>
         <alpine.DEB.2.20.1710192328110.2054@nanos>
Content-Type: text/plain; charset="UTF-8"
X-Mailer: Evolution 3.24.6 (3.24.6-1.fc26) 
Mime-Version: 1.0
Content-Transfer-Encoding: 7bit
X-CMAE-Envelope: MS4wfDDOPiGyalfq1QQwTjTeRECm1n2wCPefwNLmX4wZvnbS/dfm/ZRTsu9VIEdIjTO+bGpWlQqDxHNMAzN32276P4XeaEKqq+MT9kvt6VH0RpiV3WlNgJtk
 9QPMP4DzdZ/obdSgLxG4cccEEw2QrmoC3+2dALhEJMYaOHZ/p+y9iobDawnZbUo005vuNE41NlgagD6qtm7b44Ot9sw8rrO+XjH5XzBJOVapuJi/G0rh3G3v
 l2iFi9dFyqclbGIFHR/GC1pFcDji/rNwtgGs+OX5tJ5shYvF5m/rkd4ZzTsnNxWu4XNOQyK7vW3nnjLKnrJhDEpS4ZxgV93xqqZNIyWggyK583GVV+YHh5Si
 +Pu+u0loSFZbxaqg8p6nu6Ksp8KEAlv5iT1K7jaLpxzA0LinRZXKX8ISEzMnpQtgSgdUiJ4bBdQ1mn01Micd169B/WIoGj/j/05/MIdYSSGZmo2D9Lg=
Sender: linux-kernel-owner@vger.kernel.org
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

On Thu, 2017-10-19 at 23:31 +0200, Thomas Gleixner wrote:
> bas_gigaset_exit()
> {
>         for (i = 0; i < driver->minors; i++) {
>                 if (gigaset_shutdown(driver->cs + i) < 0)
> 
> gigaset_shutdown(cs)
> {
> 	mutex_lock(&cs->mutex); <-------- Explodes here
> 
> So driver->cs + i is invalid. No idea how that might be related to that
> timer conversion patch, but ....

Thanks for peeking into this!

Please note that driver->minors is one of the more embarrassing warts of the
gigaset code. It's basically hardcoded to 1 for all three drivers (including
bas_gigaset). So driver->cs itself is invalid here.

And since the patch uses
    struct cardstate *cs = urb->context;

in a few places my guess is that it's really the patch that triggers this.

Thanks,


Paul Bolle