mirror of https://lore.kernel.org/lkml/
 help / color / mirror / Atom feed
From: alexander.levin@verizon.com
To: "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
	"stable@vger.kernel.org" <stable@vger.kernel.org>
Cc: hayeswang <hayeswang@realtek.com>,
	"David S . Miller" <davem@davemloft.net>,
	alexander.levin@verizon.com
Subject: [PATCH AUTOSEL for 4.9 011/100] r8152: fix the list rx_done may be used without initialization
Date: Wed, 13 Dec 2017 01:56:16 +0000	[thread overview]
Message-ID: <20171213015606.6568-11-alexander.levin@verizon.com> (raw)
In-Reply-To: <20171213015606.6568-1-alexander.levin@verizon.com>

From: hayeswang <hayeswang@realtek.com>

[ Upstream commit 98d068ab52b4b11d403995ed14154660797e7136 ]

The list rx_done would be initialized when the linking on occurs.
Therefore, if a napi is scheduled without any linking on before,
the following kernel panic would happen.

	BUG: unable to handle kernel NULL pointer dereference at 000000000000008
	IP: [<ffffffffc085efde>] r8152_poll+0xe1e/0x1210 [r8152]
	PGD 0
	Oops: 0002 [#1] SMP

Signed-off-by: Hayes Wang <hayeswang@realtek.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
---
 drivers/net/usb/r8152.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c
index afb953a258cd..823219cf95ef 100644
--- a/drivers/net/usb/r8152.c
+++ b/drivers/net/usb/r8152.c
@@ -1362,6 +1362,7 @@ static int alloc_all_mem(struct r8152 *tp)
 	spin_lock_init(&tp->rx_lock);
 	spin_lock_init(&tp->tx_lock);
 	INIT_LIST_HEAD(&tp->tx_free);
+	INIT_LIST_HEAD(&tp->rx_done);
 	skb_queue_head_init(&tp->tx_queue);
 	skb_queue_head_init(&tp->rx_queue);
 
-- 
2.11.0

  parent reply	other threads:[~2017-12-13  2:49 UTC|newest]

Thread overview: 24+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2017-12-13  1:56 [PATCH AUTOSEL for 4.9 001/100] cxl: Route eeh events to all slices for pci_channel_io_perm_failure state alexander.levin
2017-12-13  1:56 ` [PATCH AUTOSEL for 4.9 003/100] ALSA: hda - add support for docking station for HP 840 G3 alexander.levin
2017-12-13  1:56 ` [PATCH AUTOSEL for 4.9 002/100] ALSA: hda - add support for docking station for HP 820 G2 alexander.levin
2017-12-13  1:56 ` [PATCH AUTOSEL for 4.9 004/100] kvm: fix usage of uninit spinlock in avic_vm_destroy() alexander.levin
2017-12-13  1:56 ` [PATCH AUTOSEL for 4.9 008/100] arm: kprobes: Align stack to 8-bytes in test code alexander.levin
2017-12-13  1:56 ` [PATCH AUTOSEL for 4.9 006/100] HID: corsair: Add driver Scimitar Pro RGB gaming mouse 1b1c:1b3e support to hid-corsair alexander.levin
2017-12-13  1:56 ` [PATCH AUTOSEL for 4.9 007/100] arm: kprobes: Fix the return address of multiple kretprobes alexander.levin
2017-12-13  1:56 ` [PATCH AUTOSEL for 4.9 005/100] HID: corsair: support for K65-K70 Rapidfire and Scimitar Pro RGB alexander.levin
2017-12-13  1:56 ` alexander.levin [this message]
2017-12-13  1:56 ` [PATCH AUTOSEL for 4.9 010/100] cpuidle: Validate cpu_dev in cpuidle_add_sysfs() alexander.levin
2017-12-13  1:56 ` [PATCH AUTOSEL for 4.9 009/100] nvme-loop: handle cpu unplug when re-establishing the controller alexander.levin
2017-12-13  1:56 ` [PATCH AUTOSEL for 4.9 012/100] crypto: deadlock between crypto_alg_sem/rtnl_mutex/genl_mutex alexander.levin
2017-12-13  1:56 ` [PATCH AUTOSEL for 4.9 015/100] vsock: cancel packets when failing to connect alexander.levin
2017-12-13  1:56 ` [PATCH AUTOSEL for 4.9 013/100] vsock: track pkt owner vsock alexander.levin
2017-12-13  1:56 ` [PATCH AUTOSEL for 4.9 014/100] vhost-vsock: add pkt cancel capability alexander.levin
2017-12-13  1:56 ` [PATCH AUTOSEL for 4.9 018/100] sctp: out_qlen should be updated when pruning unsent queue alexander.levin
2017-12-13  1:56 ` [PATCH AUTOSEL for 4.9 016/100] sch_dsmark: fix invalid skb_cow() usage alexander.levin
2017-12-13  1:56 ` [PATCH AUTOSEL for 4.9 019/100] net: qmi_wwan: Add USB IDs for MDM6600 modem on Motorola Droid 4 alexander.levin
2017-12-13  1:56 ` [PATCH AUTOSEL for 4.9 017/100] bna: integer overflow bug in debugfs alexander.levin
2017-12-13  1:56 ` [PATCH AUTOSEL for 4.9 021/100] usb: gadget: f_uvc: Sanity check wMaxPacketSize for SuperSpeed alexander.levin
2017-12-13  1:56 ` [PATCH AUTOSEL for 4.9 023/100] netfilter: nfnl_cthelper: fix runtime expectation policy updates alexander.levin
2017-12-13  1:56 ` [PATCH AUTOSEL for 4.9 022/100] usb: gadget: udc: remove pointer dereference after free alexander.levin
2017-12-13  1:56 ` [PATCH AUTOSEL for 4.9 020/100] hwmon: (max31790) Set correct PWM value alexander.levin
2017-12-13  1:56 ` [PATCH AUTOSEL for 4.9 024/100] netfilter: nfnl_cthelper: Fix memory leak alexander.levin

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20171213015606.6568-11-alexander.levin@verizon.com \
    --to=alexander.levin@verizon.com \
    --cc=davem@davemloft.net \
    --cc=hayeswang@realtek.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=stable@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox

all inboxes | Powered by JetHome®