1. 08 Jul, 2011 3 commits
    • Greg KH's avatar
      hso: fix a use after free condition · 5e2cd082
      Greg KH authored
      This needs to go to netdev:
      
      From: Octavian Purdila <octavian.purdila@intel.com>
      
      In hso_free_net_device hso_net pointer is freed and then used to
      cleanup urb pools. Catched with SLAB_DEBUG during S3 resume:
      
      [   95.824442] Pid: 389, comm: khubd Tainted: G         C  2.6.36greenridge-01400-g423cf13-dirty #154 Type2 - Board Product Name1/OakTrail
      [   95.824442] EIP: 0060:[<c1151551>] EFLAGS: 00010202 CPU: 0
      [   95.824442] EIP is at kref_put+0x29/0x42
      [   95.824442] EAX: 6b6b6b6b EBX: 6b6b6b6b ECX: c2806b40 EDX: 00000037
      [   95.824442] ESI: c1258d56 EDI: edd3d128 EBP: ee8cde0c ESP: ee8cde04
      [   95.824442]  DS: 007b ES: 007b FS: 00d8 GS: 0000 SS: 0068
      [   95.824442] Process khubd (pid: 389, ti=ee8cc000 task=ee95ed10 task.ti=ee8cc000)
      [   95.824442] Stack:
      [   95.824442]  edd07020 00000000 ee8cde14 c1258b77 ee8cde38 ef933a44 ef93572b ef935dec
      [   95.824442] <0> 0000099a 6b6b6b6b 00000000 ee2da748 edd3e0c0 ee8cde54 ef933b9f ee3b53f8
      [   95.824442] <0> 00000002 ee2da748 ee2da764 ef936658 ee8cde60 ef933d0c ee2da748 ee8cde84
      [   95.824442] Call Trace:
      [   95.824442]  [<c1258b77>] ? usb_free_urb+0x11/0x13
      [   95.824442]  [<ef933a44>] ? hso_free_net_device+0x81/0xd8 [hso]
      [   95.824442]  [<ef933b9f>] ? hso_free_interface+0x104/0x111 [hso]
      [   95.824442]  [<ef933d0c>] ? hso_disconnect+0xb/0x18 [hso]
      [   95.824442]  [<c125b7f1>] ? usb_unbind_interface+0x44/0x14a
      [   95.824442]  [<c11e56e8>] ? __device_release_driver+0x6f/0xb1
      [   95.824442]  [<c11e57c7>] ? device_release_driver+0x18/0x23
      [   95.824442]  [<c11e4e92>] ? bus_remove_device+0x8a/0xa1
      [   95.824442]  [<c11e3970>] ? device_del+0x129/0x163
      [   95.824442]  [<c11e2dc0>] ? put_device+0xf/0x11
      [   95.824442]  [<c11e39bc>] ? device_unregister+0x12/0x15
      [   95.824442]  [<c125915f>] ? usb_disable_device+0x90/0xf0
      [   95.824442]  [<c125544f>] ? usb_disconnect+0x6d/0xf8
      [   95.824442]  [<c1255f91>] ? hub_thread+0x3fc/0xc57
      [   95.824442]  [<c1048526>] ? autoremove_wake_function+0x0/0x2f
      [   95.824442]  [<c102529d>] ? complete+0x34/0x3e
      [   95.824442]  [<c1255b95>] ? hub_thread+0x0/0xc57
      [   95.824442]  [<c10481fc>] ? kthread+0x63/0x68
      [   95.824442]  [<c1048199>] ? kthread+0x0/0x68
      [   95.824442]  [<c1002d76>] ? kernel_thread_helper+0x6/0x10
      Signed-off-by: default avatarOctavian Purdila <octavian.purdila@intel.com>
      Signed-off-by: default avatarAlan Cox <alan@linux.intel.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      5e2cd082
    • Jean Delvare's avatar
      net/natsemi: Fix module parameter permissions · b1f524e3
      Jean Delvare authored
      The third parameter of module_param is supposed to represent sysfs
      file permissions. A value of "1" leads to the following:
      
      $ ls -l /sys/module/natsemi/parameters/
      total 0
      ---------x 1 root root 4096 Jul  8 09:46 dspcfg_workaround
      
      I am changing it to "0" to align with the other module parameters in
      this driver.
      Signed-off-by: default avatarJean Delvare <jdelvare@suse.de>
      Cc: Tim Hockin <thockin@hockin.org>
      Cc: Mark Brown <broonie@opensource.wolfsonmicro.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      b1f524e3
    • Tushar Gohad's avatar
      XFRM: Fix memory leak in xfrm_state_update · 8fcbc637
      Tushar Gohad authored
      Upon "ip xfrm state update ..", xfrm_add_sa() takes an extra reference on
      the user-supplied SA and forgets to drop the reference when
      xfrm_state_update() returns 0.  This leads to a memory leak as the
      parameter SA is never freed.  This change attempts to fix the leak by
      calling __xfrm_state_put() when xfrm_state_update() updates a valid SA
      (err = 0).  The parameter SA is added to the gc list when the final
      reference is dropped by xfrm_add_sa() upon completion.
      Signed-off-by: default avatarTushar Gohad <tgohad@mvista.com>
      Acked-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      8fcbc637
  2. 07 Jul, 2011 15 commits
  3. 06 Jul, 2011 17 commits
  4. 05 Jul, 2011 5 commits