Andreas Kemnade 4c761daf8b net: hso: register netdev later to avoid a race condition ... If the netdev is accessed before the urbs are initialized, there will be NULL pointer dereferences. That is avoided by registering it when it is fully initialized. This case occurs e.g. if dhcpcd is running in the background and the device is probed, either after insmod hso or when the device appears on the usb bus. A backtrace is the following: [ 1357.356048] usb 1-2: new high-speed USB device number 12 using ehci-omap [ 1357.551177] usb 1-2: New USB device found, idVendor=0af0, idProduct=8800 [ 1357.558654] usb 1-2: New USB device strings: Mfr=3, Product=2, SerialNumber=0 [ 1357.568572] usb 1-2: Product: Globetrotter HSUPA Modem [ 1357.574096] usb 1-2: Manufacturer: Option N.V. [ 1357.685882] hso 1-2:1.5: Not our interface [ 1460.886352] hso: unloaded [ 1460.889984] usbcore: deregistering interface driver hso [ 1513.769134] hso: ../drivers/net/usb/hso.c: Option Wireless [ 1513.846771] Unable to handle kernel NULL pointer dereference at virtual address 00000030 [ 1513.887664] hso 1-2:1.5: Not our interface [ 1513.906890] usbcore: registered new interface driver hso [ 1513.937988] pgd = ecdec000 [ 1513.949890] [00000030] *pgd=acd15831, *pte=00000000, *ppte=00000000 [ 1513.956573] Internal error: Oops: 817 [#1] PREEMPT SMP ARM [ 1513.962371] Modules linked in: hso usb_f_ecm omap2430 bnep bluetooth g_ether usb_f_rndis u_ether libcomposite configfs ipv6 arc4 wl18xx wlcore mac80211 cfg80211 bq27xxx_battery panel_tpo_td028ttec1 omapdrm drm_kms_helper cfbfillrect snd_soc_simple_card syscopyarea cfbimgblt snd_soc_simple_card_utils sysfillrect sysimgblt fb_sys_fops snd_soc_omap_twl4030 cfbcopyarea encoder_opa362 drm twl4030_madc_hwmon wwan_on_off snd_soc_gtm601 pwm_omap_dmtimer generic_adc_battery connector_analog_tv pwm_bl extcon_gpio omap3_isp wlcore_sdio videobuf2_dma_contig videobuf2_memops w1_bq27000 videobuf2_v4l2 videobuf2_core omap_hdq snd_soc_omap_mcbsp ov9650 snd_soc_omap bmp280_i2c bmg160_i2c v4l2_common snd_pcm_dmaengine bmp280 bmg160_core at24 bmc150_magn_i2c nvmem_core videodev phy_twl4030_usb bmc150_accel_i2c tsc2007 [ 1514.037384] bmc150_magn bmc150_accel_core media leds_tca6507 bno055 industrialio_triggered_buffer kfifo_buf gpio_twl4030 musb_hdrc snd_soc_twl4030 twl4030_vibra twl4030_madc twl4030_pwrbutton twl4030_charger industrialio w2sg0004 ehci_omap omapdss [last unloaded: hso] [ 1514.062622] CPU: 0 PID: 3433 Comm: dhcpcd Tainted: G W 4.11.0-rc8-letux+ #1 [ 1514.071136] Hardware name: Generic OMAP36xx (Flattened Device Tree) [ 1514.077758] task: ee748240 task.stack: ecdd6000 [ 1514.082580] PC is at hso_start_net_device+0x50/0xc0 [hso] [ 1514.088287] LR is at hso_net_open+0x68/0x84 [hso] [ 1514.093231] pc : [<bf79c304>] lr : [<bf79ced8>] psr: a00f0013 sp : ecdd7e20 ip : 00000000 fp : ffffffff [ 1514.105316] r10: 00000000 r9 : ed0e080c r8 : ecd8fe2c [ 1514.110839] r7 : bf79cef4 r6 : ecd8fe00 r5 : 00000000 r4 : ed0dbd80 [ 1514.117706] r3 : 00000000 r2 : c0020c80 r1 : 00000000 r0 : ecdb7800 [ 1514.124572] Flags: NzCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment none [ 1514.132110] Control: 10c5387d Table: acdec019 DAC: 00000051 [ 1514.138153] Process dhcpcd (pid: 3433, stack limit = 0xecdd6218) [ 1514.144470] Stack: (0xecdd7e20 to 0xecdd8000) [ 1514.149078] 7e20: ed0dbd80 ecd8fe98 00000001 00000000 ecd8f800 ecd8fe00 ecd8fe60 00000000 [ 1514.157714] 7e40: ed0e080c bf79ced8 bf79ce70 ecd8f800 00000001 bf7a0258 ecd8f830 c068d958 [ 1514.166320] 7e60: c068d8b8 ecd8f800 00000001 00001091 00001090 c068dba4 ecd8f800 00001090 [ 1514.174926] 7e80: ecd8f940 ecd8f800 00000000 c068dc60 00000000 00000001 ed0e0800 ecd8f800 [ 1514.183563] 7ea0: 00000000 c06feaa8 c0ca39c2 beea57dc 00000020 00000000 306f7368 00000000 [ 1514.192169] 7ec0: 00000000 00000000 00001091 00000000 00000000 00000000 00000000 00008914 [ 1514.200805] 7ee0: eaa9ab60 beea57dc c0c9bfc0 eaa9ab40 00000006 00000000 00046858 c066a948 [ 1514.209411] 7f00: beea57dc eaa9ab60 ecc6b0c0 c02837b0 00000006 c0282c90 0000c000 c0283654 [ 1514.218017] 7f20: c09b0c00 c098bc31 00000001 c0c5e513 c0c5e513 00000000 c0151354 c01a20c0 [ 1514.226654] 7f40: c0c5e513 c01a3134 ecdd6000 c01a3160 ee7487f0 600f0013 00000000 ee748240 [ 1514.235260] 7f60: ee748734 00000000 ecc6b0c0 ecc6b0c0 beea57dc 00008914 00000006 00000000 [ 1514.243896] 7f80: 00046858 c02837b0 00001091 0003a1f0 00046608 0003a248 00000036 c01071e4 [ 1514.252502] 7fa0: ecdd6000 c0107040 0003a1f0 00046608 00000006 00008914 beea57dc 00001091 [ 1514.261108] 7fc0: 0003a1f0 00046608 0003a248 00000036 0003ac0c 00046608 00046610 00046858 [ 1514.269744] 7fe0: 0003a0ac beea57d4 000167eb b6f23106 400f0030 00000006 00000000 00000000 [ 1514.278411] [<bf79c304>] (hso_start_net_device [hso]) from [<bf79ced8>] (hso_net_open+0x68/0x84 [hso]) [ 1514.288238] [<bf79ced8>] (hso_net_open [hso]) from [<c068d958>] (__dev_open+0xa0/0xf4) [ 1514.296600] [<c068d958>] (__dev_open) from [<c068dba4>] (__dev_change_flags+0x8c/0x130) [ 1514.305023] [<c068dba4>] (__dev_change_flags) from [<c068dc60>] (dev_change_flags+0x18/0x48) [ 1514.313934] [<c068dc60>] (dev_change_flags) from [<c06feaa8>] (devinet_ioctl+0x348/0x714) [ 1514.322540] [<c06feaa8>] (devinet_ioctl) from [<c066a948>] (sock_ioctl+0x2b0/0x308) [ 1514.330627] [<c066a948>] (sock_ioctl) from [<c0282c90>] (vfs_ioctl+0x20/0x34) [ 1514.338165] [<c0282c90>] (vfs_ioctl) from [<c0283654>] (do_vfs_ioctl+0x82c/0x93c) [ 1514.346038] [<c0283654>] (do_vfs_ioctl) from [<c02837b0>] (SyS_ioctl+0x4c/0x74) [ 1514.353759] [<c02837b0>] (SyS_ioctl) from [<c0107040>] (ret_fast_syscall+0x0/0x1c) [ 1514.361755] Code: e3822103 e3822080 e1822781 e5981014 (e5832030) [ 1514.510833] ---[ end trace dfb3e53c657f34a0 ]--- Reported-by: H. Nikolaus Schaller <hns@goldelico.com> Signed-off-by: Andreas Kemnade <andreas@kemnade.info> Reviewed-by: Johan Hovold <johan@kernel.org> Signed-off-by: David S. Miller <davem@davemloft.net>		2017-04-28 16:11:48 -04:00
..
appletalk	…
arcnet	lib/vsprintf.c: remove %Z support	2017-02-27 18:43:47 -08:00
bonding	bonding: avoid defaulting hard_header_len to ETH_HLEN on slave removal	2017-04-28 16:04:05 -04:00
caif	virtio: allow drivers to request IRQ affinity when creating VQs	2017-02-27 20:54:04 +02:00
can	net: can: usb: gs_usb: Fix buffer on stack	2017-04-25 14:08:35 +02:00
cris	…
dsa	net: dsa: b53: Fix CPU port for 58xx devices	2017-04-24 18:28:56 -04:00
ethernet	cpsw/netcp: refine cpts dependency	2017-04-28 15:55:14 -04:00
fddi	…
fjes	fjes: Do not load fjes driver if extended socket device is not power on.	2017-03-22 12:38:17 -07:00
hamradio	driver core patches for 4.11-rc1	2017-02-22 11:44:32 -08:00
hippi	…
hyperv	netvsc: fix calculation of available send sections	2017-04-25 11:56:59 -04:00
ieee802154	ieee802154: atusb: fix driver to work with older firmware versions	2017-01-12 22:12:43 +01:00
ipvlan	ipvtap: IP-VLAN based tap driver	2017-02-11 20:59:41 -05:00
irda	irda: vlsi_ir: fix check for DMA mapping errors	2017-03-25 20:14:40 -07:00
phy	Revert "phy: micrel: Disable auto negotiation on startup"	2017-04-26 14:34:07 -04:00
plip	…
ppp	sched/headers: Prepare to move signal wakeup & sigpending methods from <linux/sched.h> into <linux/sched/signal.h>	2017-03-02 08:42:32 +01:00
slip	sched/headers: Prepare for new header dependencies before moving code to <linux/sched/signal.h>	2017-03-02 08:42:29 +01:00
team	team: fix memory leaks	2017-04-25 11:35:01 -04:00
usb	net: hso: register netdev later to avoid a race condition	2017-04-28 16:11:48 -04:00
vmxnet3	drivers: net: generalize napi_complete_done()	2017-01-30 15:10:42 -05:00
wan	ucc/hdlc: fix two little issue	2017-03-13 21:53:48 -07:00
wimax	net: wimax/i2400m: fix NULL-deref at probe	2017-03-13 12:28:40 -07:00
wireless	brcmfmac: use local iftype avoiding use-after-free of virtual interface	2017-03-30 19:43:51 +03:00
xen-netback	xen-netback: fix race condition on XenBus disconnect	2017-03-12 23:44:43 -07:00
Kconfig	vmxnet3: prevent building with 64K pages	2017-02-17 15:25:49 -05:00
LICENSE.SRC	…
Makefile	ipvtap: IP-VLAN based tap driver	2017-02-11 20:59:41 -05:00
Space.c	…
dummy.c	net: dummy: Introduce dummy virtual functions	2017-01-24 14:07:22 -05:00
eql.c	…
geneve.c	geneve: lock RCU on TX path	2017-03-01 09:58:31 -08:00
gtp.c	lib/vsprintf.c: remove %Z support	2017-02-27 18:43:47 -08:00
ifb.c	…
loopback.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2017-02-11 02:31:11 -05:00
macsec.c	macsec: dynamically allocate space for sglist	2017-04-26 14:41:53 -04:00
macvlan.c	macvlan: Fix device ref leak when purging bc_queue	2017-04-25 10:42:10 -04:00
macvtap.c	sched/headers: Prepare to move signal wakeup & sigpending methods from <linux/sched.h> into <linux/sched/signal.h>	2017-03-02 08:42:32 +01:00
mdio.c	…
mii.c	…
netconsole.c	…
nlmon.c	…
ntb_netdev.c	…
rionet.c	…
sb1000.c	…
sungem_phy.c	…
tap.c	sched/headers: Move task_struct::signal and task_struct::sighand types and accessors into <linux/sched/signal.h>	2017-03-03 01:43:37 +01:00
tun.c	tun: fix inability to set offloads after disabling them via ethtool	2017-03-21 15:30:59 -07:00
veth.c	…
virtio_net.c	virtio_net: clear MTU when out of range	2017-04-07 16:38:59 +03:00
vrf.c	net: vrf: Fix setting NLM_F_EXCL flag when adding l3mdev rule	2017-04-17 13:27:54 -04:00
vxlan.c	vxlan: fix ovs support	2017-03-13 16:03:42 -07:00
xen-netfront.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next	2017-02-22 10:15:09 -08:00