From: Greg KH <gregkh@suse.de>
To: linux-kernel@vger.kernel.org, stable@kernel.org
Cc: stable-review@kernel.org, torvalds@linux-foundation.org,
akpm@linux-foundation.org, alan@lxorguk.ukuu.org.uk,
Max Vozeler <max@vozeler.com>
Subject: [14/73] staging: usbip: vhci: update reference count for usb_device
Date: Fri, 04 Mar 2011 16:55:19 -0800 [thread overview]
Message-ID: <20110305005635.967594116@clark.kroah.org> (raw)
In-Reply-To: <20110305005720.GA16162@kroah.com>
2.6.37-stable review patch. If anyone has any objections, please let us know.
------------------
From: Max Vozeler <max@vozeler.com>
commit 7606ee8aa33287dd3e6eb44c78541b87a413a325 upstream.
This fixes an oops observed when reading status during
removal of a device:
[ 1706.648285] general protection fault: 0000 [#1] SMP
[ 1706.648294] last sysfs file: /sys/devices/platform/vhci_hcd/status
[ 1706.648297] CPU 1
[ 1706.648300] Modules linked in: binfmt_misc microcode fuse loop vhci_hcd(N) usbip(N) usbcore usbip_common_mod(N) rtc_core rtc_lib joydev dm_mirror dm_region_hash dm_log linear dm_snapshot xennet dm_mod ext3 mbcache jbd processor thermal_sys hwmon xenblk cdrom
[ 1706.648324] Supported: Yes
[ 1706.648327] Pid: 10422, comm: usbip Tainted: G N 2.6.32.12-0.7-xen #1
[ 1706.648330] RIP: e030:[<ffffffff801b10d5>] [<ffffffff801b10d5>] strnlen+0x5/0x40
[ 1706.648340] RSP: e02b:ffff8800a994dd30 EFLAGS: 00010286
[ 1706.648343] RAX: ffffffff80481ec1 RBX: 0000000000000000 RCX: 0000000000000002
[ 1706.648347] RDX: 00200d1d4f1c001c RSI: ffffffffffffffff RDI: 00200d1d4f1c001c
[ 1706.648350] RBP: ffff880129a1c0aa R08: ffffffffa01901c4 R09: 0000000000000006
[ 1706.648353] R10: 0000000000000000 R11: 0000000000000000 R12: ffff8800a9a1c0ab
[ 1706.648357] R13: 00200d1d4f1c001c R14: 00000000ffffffff R15: ffff880129a1c0aa
[ 1706.648363] FS: 00007f2f2e9ca700(0000) GS:ffff880001018000(0000) knlGS:0000000000000000
[ 1706.648367] CS: e033 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 1706.648370] CR2: 000000000071b048 CR3: 00000000b4b68000 CR4: 0000000000002660
[ 1706.648374] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 1706.648378] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
[ 1706.648381] Process usbip (pid: 10422, threadinfo ffff8800a994c000, task ffff88007b170200)
[ 1706.648385] Stack:
[ 1706.648387] ffffffff801b28c9 0000000000000002 ffffffffa01901c4 ffff8800a9a1c0ab
[ 1706.648391] <0> ffffffffa01901c6 ffff8800a994de08 ffffffff801b339b 0000000000000004
[ 1706.648397] <0> 0000000affffffff ffffffffffffffff 00000000000067c0 0000000000000000
[ 1706.648404] Call Trace:
[ 1706.648413] [<ffffffff801b28c9>] string+0x39/0xe0
[ 1706.648419] [<ffffffff801b339b>] vsnprintf+0x1eb/0x620
[ 1706.648423] [<ffffffff801b3813>] sprintf+0x43/0x50
[ 1706.648429] [<ffffffffa018d719>] show_status+0x1b9/0x220 [vhci_hcd]
[ 1706.648438] [<ffffffff8024a2b7>] dev_attr_show+0x27/0x60
[ 1706.648445] [<ffffffff80144821>] sysfs_read_file+0x101/0x1d0
[ 1706.648451] [<ffffffff800da4a7>] vfs_read+0xc7/0x130
[ 1706.648457] [<ffffffff800da613>] sys_read+0x53/0xa0
[ 1706.648462] [<ffffffff80007458>] system_call_fastpath+0x16/0x1b
[ 1706.648468] [<00007f2f2de40f30>] 0x7f2f2de40f30
[ 1706.648470] Code: 66 0f 1f 44 00 00 48 83 c2 01 80 3a 00 75 f7 48 89 d0 48 29 f8 f3 c3 66 66 66 66 66 66 2e 0f 1f 84 00 00 00 00 00 48 85 f6 74 29 <80> 3f 00 74 24 48 8d 56 ff 48 89 f8 eb 0e 0f 1f 44 00 00 48 83
[ 1706.648507] RIP [<ffffffff801b10d5>] strnlen+0x5/0x40
[ 1706.648511] RSP <ffff8800a994dd30>
[ 1706.649575] ---[ end trace b4eb72bf2e149593 ]---
Signed-off-by: Max Vozeler <max@vozeler.com>
Tested-by: Mark Wehby <MWehby@luxotticaRetail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
drivers/staging/usbip/vhci_hcd.c | 13 ++++++++++---
1 file changed, 10 insertions(+), 3 deletions(-)
--- a/drivers/staging/usbip/vhci_hcd.c
+++ b/drivers/staging/usbip/vhci_hcd.c
@@ -607,7 +607,9 @@ static int vhci_urb_enqueue(struct usb_h
dev_info(dev, "SetAddress Request (%d) to port %d\n",
ctrlreq->wValue, vdev->rhport);
- vdev->udev = urb->dev;
+ if (vdev->udev)
+ usb_put_dev(vdev->udev);
+ vdev->udev = usb_get_dev(urb->dev);
spin_lock(&vdev->ud.lock);
vdev->ud.status = VDEV_ST_USED;
@@ -627,8 +629,9 @@ static int vhci_urb_enqueue(struct usb_h
"Get_Descriptor to device 0 "
"(get max pipe size)\n");
- /* FIXME: reference count? (usb_get_dev()) */
- vdev->udev = urb->dev;
+ if (vdev->udev)
+ usb_put_dev(vdev->udev);
+ vdev->udev = usb_get_dev(urb->dev);
goto out;
default:
@@ -887,6 +890,10 @@ static void vhci_device_reset(struct usb
vdev->speed = 0;
vdev->devid = 0;
+ if (vdev->udev)
+ usb_put_dev(vdev->udev);
+ vdev->udev = NULL;
+
ud->tcp_socket = NULL;
ud->status = VDEV_ST_NULL;
next prev parent reply other threads:[~2011-03-05 1:18 UTC|newest]
Thread overview: 74+ messages / expand[flat|nested] mbox.gz Atom feed top
2011-03-05 0:57 [00/73] 2.6.37.3-stable review Greg KH
2011-03-05 0:55 ` [01/73] usb: musb: omap2430: fix kernel panic on reboot Greg KH
2011-03-05 0:55 ` [02/73] USB: add quirks entry for Keytouch QWERTY Panel Greg KH
2011-03-05 0:55 ` [03/73] USB: Add Samsung SGH-I500/Android modem ID switch to visor driver Greg KH
2011-03-05 0:55 ` [04/73] USB: Add quirk for Samsung Android phone modem Greg KH
2011-03-05 0:55 ` [05/73] USB: serial/usb_wwan, fix tty NULL dereference Greg KH
2011-03-05 0:55 ` [06/73] sierra: add new ID for Airprime/Sierra USB IP modem Greg KH
2011-03-05 0:55 ` [07/73] Revert "Bluetooth: Enable USB autosuspend by default on btusb" Greg KH
2011-03-05 0:55 ` [08/73] p54pci: update receive dma buffers before and after processing Greg KH
2011-03-05 0:55 ` [09/73] Revert "drm/radeon/kms: switch back to min->max pll post divider iteration" Greg KH
2011-03-05 0:55 ` [10/73] tcp: fix inet_twsk_deschedule() Greg KH
2011-03-05 0:55 ` [11/73] mm: prevent concurrent unmap_mapping_range() on the same inode Greg KH
2011-03-05 0:55 ` [12/73] staging: brcm80211: remove assert to avoid panic since 2.6.37 kernel Greg KH
2011-03-05 0:55 ` [13/73] staging: brcm80211: bugfix for softmac crash on multi cpu configurations Greg KH
2011-03-05 0:55 ` Greg KH [this message]
2011-03-05 0:55 ` [15/73] staging: usbip: vhci: give back URBs from in-flight unlink requests Greg KH
2011-03-05 0:55 ` [16/73] staging: usbip: vhci: refuse to enqueue for dead connections Greg KH
2011-03-05 0:55 ` [17/73] staging: usbip: vhci: use urb->dev->portnum to find port Greg KH
2011-03-05 0:55 ` [18/73] epoll: prevent creating circular epoll structures Greg KH
2011-03-05 0:55 ` [19/73] swiotlb: fix wrong panic Greg KH
2011-03-05 0:55 ` [20/73] ldm: corrupted partition table can cause kernel oops Greg KH
2011-03-05 0:55 ` [21/73] drivers/rtc/rtc-ds3232.c: fix time range difference between linux and RTC chip Greg KH
2011-03-05 0:55 ` [22/73] mm: fix dubious code in __count_immobile_pages() Greg KH
2011-03-05 0:55 ` [23/73] md: correctly handle probe of an mdp device Greg KH
2011-03-05 0:55 ` [24/73] md: avoid spinlock problem in blk_throtl_exit Greg KH
2011-03-05 0:55 ` [25/73] md: Fix - again - partition detection when array becomes active Greg KH
2011-03-05 0:55 ` [26/73] Fix over-zealous flush_disk when changing device size Greg KH
2011-03-05 0:55 ` [27/73] PM: Make ACPI wakeup from S5 work again when CONFIG_PM_SLEEP is unset Greg KH
2011-03-05 0:55 ` [28/73] x86 quirk: Fix polarity for IRQ0 pin2 override on SB800 systems Greg KH
2011-03-05 0:55 ` [29/73] xhci: Avoid BUG() in interrupt context Greg KH
2011-03-05 0:55 ` [30/73] xhci: Clarify some expressions in the TRB math Greg KH
2011-03-05 0:55 ` [31/73] xhci: Fix errors in the running total calculations " Greg KH
2011-03-05 0:55 ` [32/73] xhci: Fix an error in count_sg_trbs_needed() Greg KH
2011-03-05 0:55 ` [33/73] USB: Reset USB 3.0 devices on (re)discovery Greg KH
2011-03-05 0:55 ` [34/73] USB: prevent buggy hubs from crashing the USB stack Greg KH
2011-03-05 0:55 ` [35/73] usb: musb: core: set has_tt flag Greg KH
2011-03-05 0:55 ` [36/73] ALSA: HDA: Add a new Conexant codec 506e (20590) Greg KH
2011-03-05 0:55 ` [37/73] ALSA: usb-audio: fix oops due to cleanup race when disconnecting Greg KH
2011-03-05 0:55 ` [38/73] ALSA: HDA: Fix mic initialization in VIA auto parser Greg KH
2011-03-05 0:55 ` [39/73] ALSA: HDA: Add ideapad quirk for two Dell machines Greg KH
2011-03-05 0:55 ` [40/73] ocfs2: Check heartbeat mode for kernel stacks only Greg KH
2011-03-05 0:55 ` [41/73] Ocfs2/refcounttree: Fix a bug for refcounttree to writeback clusters in a right number Greg KH
2011-03-05 0:55 ` [42/73] drm: fix unsigned vs signed comparison issue in modeset ctl ioctl Greg KH
2011-03-05 0:55 ` [43/73] ACPI / debugfs: Fix buffer overflows, double free Greg KH
2011-03-05 0:55 ` [44/73] mfd: Avoid tps6586x burst writes Greg KH
2011-03-05 0:55 ` [45/73] mfd: Fix NULL pointer due to non-initialized ucb1x00-ts absinfo Greg KH
2011-03-05 0:55 ` [46/73] x86: Use u32 instead of long to set reset vector back to 0 Greg KH
2011-03-05 0:55 ` [47/73] Bluetooth: add Atheros BT AR9285 fw supported Greg KH
2011-03-05 0:55 ` [48/73] Bluetooth: fix crash with quirky dongles doing sound Greg KH
2011-03-05 0:55 ` [49/73] Bluetooth: Add Atheros BT AR5BBU12 fw supported Greg KH
2011-03-05 0:55 ` [50/73] eukrea-tlv320: fix platform_name Greg KH
2011-03-05 0:55 ` [51/73] ASoC: correct pxa AC97 DAI names Greg KH
2011-03-05 0:55 ` [52/73] fuse: fix hang of single threaded fuseblk filesystem Greg KH
2011-03-05 0:55 ` [53/73] clockevents: Prevent oneshot mode when broadcast device is periodic Greg KH
2011-03-05 0:55 ` [54/73] ext2: Fix link count corruption under heavy link+rename load Greg KH
2011-03-05 0:56 ` [55/73] mm: vmstat: use a single setter function and callback for adjusting percpu thresholds Greg KH
2011-03-05 0:56 ` [56/73] e1000e: 82579 PHY incorrectly identified during init Greg KH
2011-03-05 0:56 ` [57/73] Staging: comedi: Add MODULE_LICENSE and similar to NI modules Greg KH
2011-03-05 0:56 ` [58/73] fix cfg80211_wext_siwfreq lock ordering Greg KH
2011-03-05 0:56 ` [59/73] tg3: Restrict phy ioctl access Greg KH
2011-03-05 0:56 ` [60/73] drm/i915: fix memory corruption with GM965 and >4GB RAM Greg KH
2011-03-05 0:56 ` [61/73] blk-throttle: Do not use kblockd workqueue for throtl work Greg KH
2011-03-05 0:56 ` [62/73] block: add @force_kblockd to __blk_run_queue() Greg KH
2011-03-05 0:56 ` [63/73] block: blk-flush shouldnt call directly into q->request_fn() __blk_run_queue() Greg KH
2011-03-05 0:56 ` [64/73] block: kill loop_mutex Greg KH
2011-03-05 0:56 ` [65/73] ath9k_htc: Fix an endian issue Greg KH
2011-03-05 0:56 ` [66/73] p54usb: add Senao NUB-350 usbid Greg KH
2011-03-05 0:56 ` [67/73] nilfs2: fix regression that i-flag is not set on changeless checkpoints Greg KH
2011-03-05 0:56 ` [68/73] carl9170: add Airlive X.USB a/b/g/n USBID Greg KH
2011-03-05 0:56 ` [69/73] r8169: disable ASPM Greg KH
2011-03-05 0:56 ` [70/73] dccp: fix oops on Reset after close Greg KH
2011-03-05 0:56 ` [71/73] e1000e: disable broken PHY wakeup for ICH10 LOMs, use MAC wakeup instead Greg KH
2011-03-05 0:56 ` [72/73] DNS: Fix a NULL pointer deref when trying to read an error key [CVE-2011-1076] Greg KH
2011-03-05 0:56 ` [73/73] arp_notify: unconditionally send gratuitous ARP for NETDEV_NOTIFY_PEERS Greg KH
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20110305005635.967594116@clark.kroah.org \
--to=gregkh@suse.de \
--cc=akpm@linux-foundation.org \
--cc=alan@lxorguk.ukuu.org.uk \
--cc=linux-kernel@vger.kernel.org \
--cc=max@vozeler.com \
--cc=stable-review@kernel.org \
--cc=stable@kernel.org \
--cc=torvalds@linux-foundation.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®