From: Greg KH <gregkh@suse.de>
To: linux-kernel@vger.kernel.org, stable@kernel.org
Cc: stable-review@kernel.org, torvalds@linux-foundation.org,
akpm@linux-foundation.org, alan@lxorguk.ukuu.org.uk,
Max Vozeler <max@vozeler.com>
Subject: [57/68] staging: usbip: vhci: update reference count for usb_device
Date: Mon, 28 Feb 2011 08:23:18 -0800 [thread overview]
Message-ID: <20110228162411.422053830@clark.kroah.org> (raw)
In-Reply-To: <20110228163502.GA27221@kroah.com>
2.6.32-longterm review patch. If anyone has any objections, please let us know.
------------------
From: Max Vozeler <max@vozeler.com>
commit 7606ee8aa33287dd3e6eb44c78541b87a413a325 upstream.
This fixes an oops observed when reading status during
removal of a device:
[ 1706.648285] general protection fault: 0000 [#1] SMP
[ 1706.648294] last sysfs file: /sys/devices/platform/vhci_hcd/status
[ 1706.648297] CPU 1
[ 1706.648300] Modules linked in: binfmt_misc microcode fuse loop vhci_hcd(N) usbip(N) usbcore usbip_common_mod(N) rtc_core rtc_lib joydev dm_mirror dm_region_hash dm_log linear dm_snapshot xennet dm_mod ext3 mbcache jbd processor thermal_sys hwmon xenblk cdrom
[ 1706.648324] Supported: Yes
[ 1706.648327] Pid: 10422, comm: usbip Tainted: G N 2.6.32.12-0.7-xen #1
[ 1706.648330] RIP: e030:[<ffffffff801b10d5>] [<ffffffff801b10d5>] strnlen+0x5/0x40
[ 1706.648340] RSP: e02b:ffff8800a994dd30 EFLAGS: 00010286
[ 1706.648343] RAX: ffffffff80481ec1 RBX: 0000000000000000 RCX: 0000000000000002
[ 1706.648347] RDX: 00200d1d4f1c001c RSI: ffffffffffffffff RDI: 00200d1d4f1c001c
[ 1706.648350] RBP: ffff880129a1c0aa R08: ffffffffa01901c4 R09: 0000000000000006
[ 1706.648353] R10: 0000000000000000 R11: 0000000000000000 R12: ffff8800a9a1c0ab
[ 1706.648357] R13: 00200d1d4f1c001c R14: 00000000ffffffff R15: ffff880129a1c0aa
[ 1706.648363] FS: 00007f2f2e9ca700(0000) GS:ffff880001018000(0000) knlGS:0000000000000000
[ 1706.648367] CS: e033 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 1706.648370] CR2: 000000000071b048 CR3: 00000000b4b68000 CR4: 0000000000002660
[ 1706.648374] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 1706.648378] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
[ 1706.648381] Process usbip (pid: 10422, threadinfo ffff8800a994c000, task ffff88007b170200)
[ 1706.648385] Stack:
[ 1706.648387] ffffffff801b28c9 0000000000000002 ffffffffa01901c4 ffff8800a9a1c0ab
[ 1706.648391] <0> ffffffffa01901c6 ffff8800a994de08 ffffffff801b339b 0000000000000004
[ 1706.648397] <0> 0000000affffffff ffffffffffffffff 00000000000067c0 0000000000000000
[ 1706.648404] Call Trace:
[ 1706.648413] [<ffffffff801b28c9>] string+0x39/0xe0
[ 1706.648419] [<ffffffff801b339b>] vsnprintf+0x1eb/0x620
[ 1706.648423] [<ffffffff801b3813>] sprintf+0x43/0x50
[ 1706.648429] [<ffffffffa018d719>] show_status+0x1b9/0x220 [vhci_hcd]
[ 1706.648438] [<ffffffff8024a2b7>] dev_attr_show+0x27/0x60
[ 1706.648445] [<ffffffff80144821>] sysfs_read_file+0x101/0x1d0
[ 1706.648451] [<ffffffff800da4a7>] vfs_read+0xc7/0x130
[ 1706.648457] [<ffffffff800da613>] sys_read+0x53/0xa0
[ 1706.648462] [<ffffffff80007458>] system_call_fastpath+0x16/0x1b
[ 1706.648468] [<00007f2f2de40f30>] 0x7f2f2de40f30
[ 1706.648470] Code: 66 0f 1f 44 00 00 48 83 c2 01 80 3a 00 75 f7 48 89 d0 48 29 f8 f3 c3 66 66 66 66 66 66 2e 0f 1f 84 00 00 00 00 00 48 85 f6 74 29 <80> 3f 00 74 24 48 8d 56 ff 48 89 f8 eb 0e 0f 1f 44 00 00 48 83
[ 1706.648507] RIP [<ffffffff801b10d5>] strnlen+0x5/0x40
[ 1706.648511] RSP <ffff8800a994dd30>
[ 1706.649575] ---[ end trace b4eb72bf2e149593 ]---
Signed-off-by: Max Vozeler <max@vozeler.com>
Tested-by: Mark Wehby <MWehby@luxotticaRetail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
drivers/staging/usbip/vhci_hcd.c | 13 ++++++++++---
1 file changed, 10 insertions(+), 3 deletions(-)
--- a/drivers/staging/usbip/vhci_hcd.c
+++ b/drivers/staging/usbip/vhci_hcd.c
@@ -606,7 +606,9 @@ static int vhci_urb_enqueue(struct usb_h
dev_info(dev, "SetAddress Request (%d) to port %d\n",
ctrlreq->wValue, vdev->rhport);
- vdev->udev = urb->dev;
+ if (vdev->udev)
+ usb_put_dev(vdev->udev);
+ vdev->udev = usb_get_dev(urb->dev);
spin_lock(&vdev->ud.lock);
vdev->ud.status = VDEV_ST_USED;
@@ -626,8 +628,9 @@ static int vhci_urb_enqueue(struct usb_h
"Get_Descriptor to device 0 "
"(get max pipe size)\n");
- /* FIXME: reference count? (usb_get_dev()) */
- vdev->udev = urb->dev;
+ if (vdev->udev)
+ usb_put_dev(vdev->udev);
+ vdev->udev = usb_get_dev(urb->dev);
goto out;
default:
@@ -886,6 +889,10 @@ static void vhci_device_reset(struct usb
vdev->speed = 0;
vdev->devid = 0;
+ if (vdev->udev)
+ usb_put_dev(vdev->udev);
+ vdev->udev = NULL;
+
ud->tcp_socket = NULL;
ud->status = VDEV_ST_NULL;
next prev parent reply other threads:[~2011-02-28 16:38 UTC|newest]
Thread overview: 72+ messages / expand[flat|nested] mbox.gz Atom feed top
2011-02-28 16:35 [00/68] 2.6.32.30-longterm review Greg KH
2011-02-28 16:22 ` [01/68] NFSD: memory corruption due to writing beyond the stat array Greg KH
2011-02-28 16:22 ` [02/68] [SCSI] mptfusion: mptctl_release is required in mptctl.c Greg KH
2011-02-28 16:22 ` [03/68] [SCSI] mptfusion: Fix Incorrect return value in mptscsih_dev_reset Greg KH
2011-02-28 16:22 ` [04/68] sctp: Fix out-of-bounds reading in sctp_asoc_get_hmac() Greg KH
2011-02-28 16:22 ` [05/68] ocfs2_connection_find() returns pointer to bad structure Greg KH
2011-02-28 16:22 ` [06/68] Fix pktcdvd ioctl dev_minor range check Greg KH
2011-02-28 16:22 ` [07/68] filter: make sure filters dont read uninitialized memory Greg KH
2011-02-28 16:22 ` [08/68] x25: decrement netdev reference counts on unload Greg KH
2011-02-28 16:22 ` [09/68] x86, hpet: Disable per-cpu hpet timer if ARAT is supported Greg KH
2011-02-28 16:22 ` [10/68] OHCI: work around for nVidia shutdown problem Greg KH
2011-02-28 16:22 ` [11/68] x86/pvclock: Zero last_value on resume Greg KH
2011-02-28 16:22 ` [12/68] [media] [v3,media] av7110: check for negative array offset Greg KH
2011-02-28 16:22 ` [13/68] CRED: Fix get_task_cred() and task_state() to not resurrect dead credentials Greg KH
2011-02-28 16:22 ` [14/68] bonding/vlan: Avoid mangled NAs on slaves without VLAN tag insertion Greg KH
2011-02-28 16:22 ` [15/68] CRED: Fix kernel panic upon security_file_alloc() failure Greg KH
2011-02-28 16:22 ` [16/68] CRED: Fix BUG() upon security_cred_alloc_blank() failure Greg KH
2011-02-28 16:22 ` [17/68] CRED: Fix memory and refcount leaks upon security_prepare_creds() failure Greg KH
2011-02-28 16:22 ` [18/68] sendfile(): check f_op.splice_write() rather than f_op.sendpage() Greg KH
2011-02-28 16:22 ` [19/68] NFS: fix the return value of nfs_file_fsync() Greg KH
2011-02-28 16:22 ` [20/68] isdn: hisax: Replace the bogus access to irq stats Greg KH
2011-02-28 16:22 ` [21/68] ixgbe: add support for 82599 based Express Module X520-P2 Greg KH
2011-02-28 16:22 ` [22/68] ixgbe: prevent speculative processing of descriptors before ready Greg KH
2011-03-01 2:14 ` [Stable-review] " Ben Hutchings
2011-03-01 20:46 ` Greg KH
2011-03-01 21:56 ` Jeff Kirsher
2011-02-28 16:22 ` [23/68] [SCSI] scsi_dh_alua: add netapp to dev list Greg KH
2011-02-28 16:22 ` [24/68] [SCSI] scsi_dh_alua: Add IBM Power Virtual SCSI ALUA device " Greg KH
2011-02-28 16:22 ` [25/68] dm raid1: fail writes if errors are not handled and log fails Greg KH
2011-02-28 16:22 ` [26/68] GFS2: Fix bmap allocation corner-case bug Greg KH
2011-02-28 16:22 ` [27/68] dm raid1: fix null pointer dereference in suspend Greg KH
2011-02-28 16:22 ` [28/68] sunrpc/cache: fix module refcnt leak in a failure path Greg KH
2011-02-28 16:22 ` [29/68] be2net: Maintain tx and rx counters in driver Greg KH
2011-02-28 16:22 ` [30/68] tcp: Increase TCP_MAXSEG socket option minimum Greg KH
2011-02-28 16:22 ` [31/68] tcp: Make TCP_MAXSEG minimum more correct Greg KH
2011-02-28 16:22 ` [32/68] nfsd: correctly handle return value from nfsd_map_name_to_* Greg KH
2011-02-28 16:22 ` [33/68] xfs: always use iget in bulkstat Greg KH
2011-02-28 16:22 ` [34/68] xfs: validate untrusted inode numbers during lookup Greg KH
2011-02-28 16:22 ` [35/68] xfs: rename XFS_IGET_BULKSTAT to XFS_IGET_UNTRUSTED Greg KH
2011-02-28 16:22 ` [36/68] xfs: remove block number from inode lookup code Greg KH
2011-02-28 16:22 ` [37/68] xfs: fix untrusted inode number lookup Greg KH
2011-02-28 16:22 ` [38/68] s390: remove task_show_regs Greg KH
2011-02-28 16:23 ` [39/68] PM / Hibernate: Return error code when alloc_image_page() fails Greg KH
2011-02-28 16:23 ` [40/68] fs/partitions: Validate map_count in Mac partition tables Greg KH
2011-02-28 16:23 ` [41/68] ALSA: HDA: Add position_fix quirk for an Asus device Greg KH
2011-02-28 16:23 ` [42/68] ALSA: caiaq - Fix possible string-buffer overflow Greg KH
2011-02-28 16:23 ` [43/68] [media] radio-aimslab.c needs #include <linux/delay.h> Greg KH
2011-02-28 16:23 ` [44/68] ARM: Ensure predictable endian state on signal handler entry Greg KH
2011-02-28 16:23 ` [45/68] acer-wmi: Fix capitalisation of GUID Greg KH
2011-02-28 16:23 ` [46/68] eCryptfs: Copy up lower inode attrs in getattr Greg KH
2011-02-28 16:23 ` [47/68] platform: x86: acer-wmi: world-writable sysfs threeg file Greg KH
2011-02-28 16:23 ` [48/68] platform: x86: asus_acpi: world-writable procfs files Greg KH
2011-02-28 16:23 ` [49/68] platform: x86: tc1100-wmi: world-writable sysfs wireless and jogdial files Greg KH
2011-02-28 16:23 ` [50/68] genirq: Disable the SHIRQ_DEBUG call in request_threaded_irq for now Greg KH
2011-02-28 16:23 ` [51/68] usb: musb: omap2430: fix kernel panic on reboot Greg KH
2011-02-28 16:23 ` [52/68] USB: add quirks entry for Keytouch QWERTY Panel Greg KH
2011-02-28 16:23 ` [53/68] USB: Add Samsung SGH-I500/Android modem ID switch to visor driver Greg KH
2011-02-28 16:23 ` [54/68] USB: Add quirk for Samsung Android phone modem Greg KH
2011-02-28 16:23 ` [55/68] p54pci: update receive dma buffers before and after processing Greg KH
2011-02-28 16:23 ` [56/68] sierra: add new ID for Airprime/Sierra USB IP modem Greg KH
2011-02-28 16:23 ` Greg KH [this message]
2011-02-28 16:23 ` [58/68] staging: usbip: vhci: give back URBs from in-flight unlink requests Greg KH
2011-02-28 16:23 ` [59/68] staging: usbip: vhci: refuse to enqueue for dead connections Greg KH
2011-02-28 16:23 ` [60/68] staging: usbip: vhci: use urb->dev->portnum to find port Greg KH
2011-02-28 16:23 ` [61/68] epoll: prevent creating circular epoll structures Greg KH
2011-02-28 16:23 ` [62/68] ldm: corrupted partition table can cause kernel oops Greg KH
2011-02-28 16:23 ` [63/68] md: correctly handle probe of an mdp device Greg KH
2011-02-28 16:23 ` [64/68] x86 quirk: Fix polarity for IRQ0 pin2 override on SB800 systems Greg KH
2011-02-28 16:23 ` [65/68] xhci: Avoid BUG() in interrupt context Greg KH
2011-02-28 16:23 ` [66/68] xhci: Clarify some expressions in the TRB math Greg KH
2011-02-28 16:23 ` [67/68] xhci: Fix errors in the running total calculations " Greg KH
2011-02-28 16:23 ` [68/68] xhci: Fix an error in count_sg_trbs_needed() Greg KH
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20110228162411.422053830@clark.kroah.org \
--to=gregkh@suse.de \
--cc=akpm@linux-foundation.org \
--cc=alan@lxorguk.ukuu.org.uk \
--cc=linux-kernel@vger.kernel.org \
--cc=max@vozeler.com \
--cc=stable-review@kernel.org \
--cc=stable@kernel.org \
--cc=torvalds@linux-foundation.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®