Skip to contentSkip to conversation

Patch "r8152: fix the list rx_done may be used without initialization" has been added to the 4.9-stable tree

PATCH [email protected] 1 participant 1 message Dec 21, 2017

Subsystems (3)
lore
Share & tools
lore

[email protected]

author maintainer Applied
#0 lore raw

This is a note to let you know that I've just added the patch titled

r8152: fix the list rx_done may be used without initialization

to the 4.9-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
r8152-fix-the-list-rx_done-may-be-used-without-initialization.patch
and it can be found in the queue-4.9 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

Quoted 1 line

From foo@baz Thu Dec 21 09:02:40 CET 2017

From: hayeswang <[email protected]>
Date: Tue, 14 Mar 2017 14:15:20 +0800
Subject: r8152: fix the list rx_done may be used without initialization

From: hayeswang <[email protected]>

[ Upstream commit 98d068ab52b4b11d403995ed14154660797e7136 ]

The list rx_done would be initialized when the linking on occurs. Therefore, if a napi is scheduled without any linking on before, the following kernel panic would happen.

	BUG: unable to handle kernel NULL pointer dereference at 000000000000008
	IP: [<ffffffffc085efde>] r8152_poll+0xe1e/0x1210 [r8152]
	PGD 0
	Oops: 0002 [#1] SMP
---
 drivers/net/usb/r8152.c |    1 +
 1 file changed, 1 insertion(+)
drivers/net/usb/r8152.c +1 -0
@@ -1362,6 +1362,7 @@ static int alloc_all_mem(struct r8152 *t
 	spin_lock_init(&tp->rx_lock);
 	spin_lock_init(&tp->tx_lock);
 	INIT_LIST_HEAD(&tp->tx_free);
+	INIT_LIST_HEAD(&tp->rx_done);
 	skb_queue_head_init(&tp->tx_queue);
 	skb_queue_head_init(&tp->rx_queue);
 

Patches currently in stable-queue which might be from [email protected] are

queue-4.9/r8152-fix-the-list-rx_done-may-be-used-without-initialization.patch queue-4.9/r8152-prevent-the-driver-from-transmitting-packets-with-carrier-off.patch queue-4.9/r8152-fix-the-rx-early-size-of-rtl8153.patch