diff options
Diffstat (limited to 'recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.23/0007-NFC-Return-from-rawsock_release-when-sk-is-NULL.patch')
-rw-r--r-- | recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.23/0007-NFC-Return-from-rawsock_release-when-sk-is-NULL.patch | 107 |
1 files changed, 107 insertions, 0 deletions
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.23/0007-NFC-Return-from-rawsock_release-when-sk-is-NULL.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.23/0007-NFC-Return-from-rawsock_release-when-sk-is-NULL.patch new file mode 100644 index 00000000..43801f4d --- /dev/null +++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.23/0007-NFC-Return-from-rawsock_release-when-sk-is-NULL.patch | |||
@@ -0,0 +1,107 @@ | |||
1 | From fd1f8dc4e31b8daeec0cb785256de7297a06e300 Mon Sep 17 00:00:00 2001 | ||
2 | From: Eric Dumazet <edumazet@google.com> | ||
3 | Date: Tue, 12 Jun 2012 00:47:58 +0200 | ||
4 | Subject: [PATCH 07/49] NFC: Return from rawsock_release when sk is NULL | ||
5 | |||
6 | commit 03e934f620101ca2cfc9383bd76172dd3e1f8567 upstream. | ||
7 | |||
8 | Sasha Levin reported following panic : | ||
9 | |||
10 | [ 2136.383310] BUG: unable to handle kernel NULL pointer dereference at | ||
11 | 00000000000003b0 | ||
12 | [ 2136.384022] IP: [<ffffffff8114e400>] __lock_acquire+0xc0/0x4b0 | ||
13 | [ 2136.384022] PGD 131c4067 PUD 11c0c067 PMD 0 | ||
14 | [ 2136.388106] Oops: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC | ||
15 | [ 2136.388106] CPU 1 | ||
16 | [ 2136.388106] Pid: 24855, comm: trinity-child1 Tainted: G W | ||
17 | 3.5.0-rc2-sasha-00015-g7b268f7 #374 | ||
18 | [ 2136.388106] RIP: 0010:[<ffffffff8114e400>] [<ffffffff8114e400>] | ||
19 | __lock_acquire+0xc0/0x4b0 | ||
20 | [ 2136.388106] RSP: 0018:ffff8800130b3ca8 EFLAGS: 00010046 | ||
21 | [ 2136.388106] RAX: 0000000000000086 RBX: ffff88001186b000 RCX: | ||
22 | 0000000000000000 | ||
23 | [ 2136.388106] RDX: 0000000000000000 RSI: 0000000000000000 RDI: | ||
24 | 0000000000000000 | ||
25 | [ 2136.388106] RBP: ffff8800130b3d08 R08: 0000000000000001 R09: | ||
26 | 0000000000000000 | ||
27 | [ 2136.388106] R10: 0000000000000000 R11: 0000000000000001 R12: | ||
28 | 0000000000000002 | ||
29 | [ 2136.388106] R13: 00000000000003b0 R14: 0000000000000000 R15: | ||
30 | 0000000000000000 | ||
31 | [ 2136.388106] FS: 00007fa5b1bd4700(0000) GS:ffff88001b800000(0000) | ||
32 | knlGS:0000000000000000 | ||
33 | [ 2136.388106] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 | ||
34 | [ 2136.388106] CR2: 00000000000003b0 CR3: 0000000011d1f000 CR4: | ||
35 | 00000000000406e0 | ||
36 | [ 2136.388106] DR0: 0000000000000000 DR1: 0000000000000000 DR2: | ||
37 | 0000000000000000 | ||
38 | [ 2136.388106] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: | ||
39 | 0000000000000400 | ||
40 | [ 2136.388106] Process trinity-child1 (pid: 24855, threadinfo | ||
41 | ffff8800130b2000, task ffff88001186b000) | ||
42 | [ 2136.388106] Stack: | ||
43 | [ 2136.388106] ffff8800130b3cd8 ffffffff81121785 ffffffff81236774 | ||
44 | 000080d000000001 | ||
45 | [ 2136.388106] ffff88001b9d6c00 00000000001d6c00 ffffffff130b3d08 | ||
46 | ffff88001186b000 | ||
47 | [ 2136.388106] 0000000000000000 0000000000000002 0000000000000000 | ||
48 | 0000000000000000 | ||
49 | [ 2136.388106] Call Trace: | ||
50 | [ 2136.388106] [<ffffffff81121785>] ? sched_clock_local+0x25/0x90 | ||
51 | [ 2136.388106] [<ffffffff81236774>] ? get_empty_filp+0x74/0x220 | ||
52 | [ 2136.388106] [<ffffffff8114e97a>] lock_acquire+0x18a/0x1e0 | ||
53 | [ 2136.388106] [<ffffffff836b37df>] ? rawsock_release+0x4f/0xa0 | ||
54 | [ 2136.388106] [<ffffffff837c0ef0>] _raw_write_lock_bh+0x40/0x80 | ||
55 | [ 2136.388106] [<ffffffff836b37df>] ? rawsock_release+0x4f/0xa0 | ||
56 | [ 2136.388106] [<ffffffff836b37df>] rawsock_release+0x4f/0xa0 | ||
57 | [ 2136.388106] [<ffffffff8321cfe8>] sock_release+0x18/0x70 | ||
58 | [ 2136.388106] [<ffffffff8321d069>] sock_close+0x29/0x30 | ||
59 | [ 2136.388106] [<ffffffff81236bca>] __fput+0x11a/0x2c0 | ||
60 | [ 2136.388106] [<ffffffff81236d85>] fput+0x15/0x20 | ||
61 | [ 2136.388106] [<ffffffff8321de34>] sys_accept4+0x1b4/0x200 | ||
62 | [ 2136.388106] [<ffffffff837c165c>] ? _raw_spin_unlock_irq+0x4c/0x80 | ||
63 | [ 2136.388106] [<ffffffff837c1669>] ? _raw_spin_unlock_irq+0x59/0x80 | ||
64 | [ 2136.388106] [<ffffffff837c2565>] ? sysret_check+0x22/0x5d | ||
65 | [ 2136.388106] [<ffffffff8321de8b>] sys_accept+0xb/0x10 | ||
66 | [ 2136.388106] [<ffffffff837c2539>] system_call_fastpath+0x16/0x1b | ||
67 | [ 2136.388106] Code: ec 04 00 0f 85 ea 03 00 00 be d5 0b 00 00 48 c7 c7 | ||
68 | 8a c1 40 84 e8 b1 a5 f8 ff 31 c0 e9 d4 03 00 00 66 2e 0f 1f 84 00 00 00 | ||
69 | 00 00 <49> 81 7d 00 60 73 5e 85 b8 01 00 00 00 44 0f 44 e0 83 fe 01 77 | ||
70 | [ 2136.388106] RIP [<ffffffff8114e400>] __lock_acquire+0xc0/0x4b0 | ||
71 | [ 2136.388106] RSP <ffff8800130b3ca8> | ||
72 | [ 2136.388106] CR2: 00000000000003b0 | ||
73 | [ 2136.388106] ---[ end trace 6d450e935ee18982 ]--- | ||
74 | [ 2136.388106] Kernel panic - not syncing: Fatal exception in interrupt | ||
75 | |||
76 | rawsock_release() should test if sock->sk is NULL before calling | ||
77 | sock_orphan()/sock_put() | ||
78 | |||
79 | Reported-by: Sasha Levin <levinsasha928@gmail.com> | ||
80 | Tested-by: Sasha Levin <levinsasha928@gmail.com> | ||
81 | Signed-off-by: Eric Dumazet <edumazet@google.com> | ||
82 | Signed-off-by: Samuel Ortiz <sameo@linux.intel.com> | ||
83 | [bwh: Backported to 3.2: keep using nfc_dbg(), not pr_debug()] | ||
84 | Signed-off-by: Ben Hutchings <ben@decadent.org.uk> | ||
85 | --- | ||
86 | net/nfc/rawsock.c | 5 ++++- | ||
87 | 1 file changed, 4 insertions(+), 1 deletion(-) | ||
88 | |||
89 | diff --git a/net/nfc/rawsock.c b/net/nfc/rawsock.c | ||
90 | index ee7b2b3..7a167fc 100644 | ||
91 | --- a/net/nfc/rawsock.c | ||
92 | +++ b/net/nfc/rawsock.c | ||
93 | @@ -52,7 +52,10 @@ static int rawsock_release(struct socket *sock) | ||
94 | { | ||
95 | struct sock *sk = sock->sk; | ||
96 | |||
97 | - nfc_dbg("sock=%p", sock); | ||
98 | + nfc_dbg("sock=%p sk=%p", sock, sk); | ||
99 | + | ||
100 | + if (!sk) | ||
101 | + return 0; | ||
102 | |||
103 | sock_orphan(sk); | ||
104 | sock_put(sk); | ||
105 | -- | ||
106 | 1.7.10 | ||
107 | |||