linux-kernel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Thomas Gleixner <tglx@linutronix.de>
To: Paul Bolle <pebolle@tiscali.nl>
Cc: Kees Cook <keescook@chromium.org>,
	"David S. Miller" <davem@davemloft.net>,
	Karsten Keil <isdn@linux-pingi.de>,
	Johan Hovold <johan@kernel.org>,
	gigaset307x-common@lists.sourceforge.net, netdev@vger.kernel.org,
	linux-kernel@vger.kernel.org
Subject: Re: [PATCH 32/58] isdn/gigaset: Convert timers to use timer_setup()
Date: Thu, 19 Oct 2017 23:31:20 +0200 (CEST)	[thread overview]
Message-ID: <alpine.DEB.2.20.1710192328110.2054@nanos> (raw)
In-Reply-To: <1508448028.2274.21.camel@tiscali.nl>

On Thu, 19 Oct 2017, Paul Bolle wrote:

> On Thu, 2017-10-19 at 23:03 +0200, Paul Bolle wrote:
> > On Mon, 2017-10-16 at 17:29 -0700, Kees Cook wrote:
> > > In preparation for unconditionally passing the struct timer_list pointer to
> > > all timer callbacks, switch to using the new timer_setup() and from_timer()
> > > to pass the timer pointer explicitly.
> > 
> > Acked-by: Paul Bolle <pebolle@tiscali.nl>
> 
> I have to take this back, sorry!
> 
> > For the record: this patch made me nervous but survived the rigorous testing I
> > threw at it. (Ie, dialing up using bas_gigaset and downloading almost 20 MB in
> > just over an hour. Whoot! That's more than good enough to ack this patch.)
> > 
> > There was some cleanup I had in mind to make this patch more straightforward.
> > But that can wait until someone finds a way to hit an issue with this patch.
> > We'll see.
> 
> That someone turns out to be me, doing "modprobe -r bas_gigaset":
> 
> <1>[30143.538135] BUG: unable to handle kernel NULL pointer dereference at 000001e9
> <1>[30143.538154] IP: mutex_lock+0x19/0x30
> <0>[30143.538300]  gigaset_shutdown+0x28/0x130 [gigaset]
> <0>[30143.538307]  ? find_module_all+0x62/0x80
> <0>[30143.538314]  bas_gigaset_exit+0x31/0x1077 [bas_gigaset]

bas_gigaset_exit()
{
        for (i = 0; i < driver->minors; i++) {
                if (gigaset_shutdown(driver->cs + i) < 0)

gigaset_shutdown(cs)
{
	mutex_lock(&cs->mutex); <-------- Explodes here

So driver->cs + i is invalid. No idea how that might be related to that
timer conversion patch, but ....

Thanks,

	tglx

  reply	other threads:[~2017-10-19 21:31 UTC|newest]

Thread overview: 81+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2017-10-17  0:28 [PATCH 00/58] networking: Convert timers to use timer_setup() Kees Cook
2017-10-17  0:28 ` [PATCH 01/58] net/decnet: " Kees Cook
2017-10-17  0:28 ` [PATCH 02/58] net/lapb: " Kees Cook
2017-10-17  0:28 ` [PATCH 03/58] net/rose: " Kees Cook
2017-10-17  0:28 ` [PATCH 04/58] net/irda-usb: " Kees Cook
2017-10-17  0:28 ` [PATCH 05/58] net/irda/bfin_sir: " Kees Cook
2017-10-17  0:28 ` [PATCH 06/58] net/ti/tlan: " Kees Cook
2017-10-17  0:28 ` [PATCH 07/58] net/usb/usbnet: " Kees Cook
2017-10-17 10:30   ` Oliver Neukum
2017-10-17  0:28 ` [PATCH 08/58] net/wireless/ray_cs: " Kees Cook
2017-10-27  7:31   ` [08/58] " Kalle Valo
2017-10-17  0:28 ` [PATCH 09/58] net/irda: " Kees Cook
2018-03-02 21:29   ` Marcelo Ricardo Leitner
2018-03-02 22:30     ` Kees Cook
2018-03-02 23:08       ` Marcelo Ricardo Leitner
2017-10-17  0:28 ` [PATCH 10/58] isdn/hisax: " Kees Cook
2017-10-17  0:28 ` [PATCH 11/58] net/hamradio/6pack: " Kees Cook
2017-10-17  0:28 ` [PATCH 12/58] xfrm: " Kees Cook
2017-10-17  0:28 ` [PATCH 13/58] ethernet/broadcom: " Kees Cook
2017-10-17  0:28 ` [PATCH 14/58] net: tulip: de2104x: " Kees Cook
2017-10-17  0:28 ` [PATCH 15/58] pcmcia/electra_cf: " Kees Cook
2017-10-17  0:29 ` [PATCH 16/58] net: ethernet: stmmac: " Kees Cook
2017-10-17  0:29 ` [PATCH 17/58] net/cw1200: " Kees Cook
2017-10-17  0:29 ` [PATCH 18/58] net: vxge: " Kees Cook
2017-10-17  0:29 ` [PATCH 19/58] drivers/atm/suni: " Kees Cook
2017-10-17  0:29 ` [PATCH 20/58] atm: idt77252: " Kees Cook
2017-10-17  0:29 ` [PATCH 21/58] net: tulip: " Kees Cook
2017-10-17  0:29 ` [PATCH 22/58] net: can: " Kees Cook
2017-10-17  0:29 ` [PATCH 23/58] drivers/net/3com: " Kees Cook
2017-10-17  0:29 ` [PATCH 24/58] chelsio: " Kees Cook
2017-10-17  0:29 ` [PATCH 25/58] net: amd8111e: " Kees Cook
2017-10-17  0:29 ` [PATCH 26/58] bna: " Kees Cook
2017-10-17  0:29 ` [PATCH 27/58] net: dl2k: " Kees Cook
2017-10-17  0:29 ` [PATCH 28/58] net: ksz884x: " Kees Cook
2017-10-17  0:29 ` [PATCH 29/58] forcedeth: " Kees Cook
2017-10-17  0:29 ` [PATCH 30/58] mISDN: " Kees Cook
2017-10-17  0:29 ` [PATCH 31/58] isdn/gigaset: Use kzalloc instead of open-coded field zeroing Kees Cook
2017-10-19 20:46   ` Paul Bolle
2017-10-17  0:29 ` [PATCH 32/58] isdn/gigaset: Convert timers to use timer_setup() Kees Cook
2017-10-19 21:03   ` Paul Bolle
2017-10-19 21:20     ` Paul Bolle
2017-10-19 21:31       ` Thomas Gleixner [this message]
2017-10-19 21:51         ` Paul Bolle
2017-10-19 22:28           ` Thomas Gleixner
2017-10-19 23:31             ` Paul Bolle
2017-10-19 21:31       ` Kees Cook
2017-10-19 22:16         ` Paul Bolle
2017-10-17  0:29 ` [PATCH 33/58] net: sched: " Kees Cook
2017-10-17  0:29 ` [PATCH 34/58] netfilter: ipset: " Kees Cook
2017-10-17  0:29 ` [PATCH 35/58] inet/connection_sock: " Kees Cook
2017-10-17  0:29 ` [PATCH 36/58] inet: frags: " Kees Cook
2017-10-17  0:29 ` [PATCH 37/58] net/core: Collapse redundant sk_timer callback data assignments Kees Cook
2017-10-17  0:29 ` [PATCH 38/58] hdlc: Convert timers to use timer_setup() Kees Cook
2017-10-17  0:29 ` [PATCH 39/58] appletalk: Remove unneeded synchronization Kees Cook
2017-10-17  0:29 ` [PATCH 40/58] drivers/net/appletalk: Convert timers to use timer_setup() Kees Cook
2017-10-17  0:29 ` [PATCH 41/58] net/atm/mpc: Stop using open-coded timer .data field Kees Cook
2017-10-17  0:29 ` [PATCH 42/58] isdnloop: Convert timers to use timer_setup() Kees Cook
2017-10-17  0:29 ` [PATCH 43/58] net: ethernet: apple: " Kees Cook
2017-10-17  0:29 ` [PATCH 44/58] net: ethernet: sun: " Kees Cook
2017-10-17 16:27   ` Shannon Nelson
2017-10-17  0:29 ` [PATCH 45/58] net: seeq: " Kees Cook
2017-10-17  0:29 ` [PATCH 46/58] hamradio/scc: " Kees Cook
2017-10-17  0:29 ` [PATCH 47/58] net/ethernet/sgi: " Kees Cook
2017-10-17  0:29 ` [PATCH 48/58] net: usb: " Kees Cook
2017-10-17  0:29 ` [PATCH 49/58] net: neterion: " Kees Cook
2017-10-17  0:29 ` [PATCH 50/58] net: hns: " Kees Cook
2017-10-17  0:29 ` [PATCH 51/58] ethernet/intel: " Kees Cook
2017-10-17  0:29 ` [PATCH 52/58] net/core: Convert sk_timer users " Kees Cook
2017-10-17  0:29 ` [PATCH 53/58] net: atm: Convert timers " Kees Cook
2017-10-17  0:29 ` [PATCH 54/58] net/xen-netback: " Kees Cook
2017-10-20 16:16   ` Wei Liu
2017-10-17  0:29 ` [PATCH 55/58] net: fs_enet: Remove unused timer Kees Cook
2017-10-17  0:29 ` [PATCH 56/58] um: net: Convert timers to use timer_setup() Kees Cook
2017-10-17  0:29 ` [PATCH 57/58] ipv4: timewait: " Kees Cook
2017-10-17  0:29 ` [PATCH 58/58] sunrpc: " Kees Cook
2017-10-17 14:18 ` [PATCH 00/58] networking: " Kalle Valo
2017-10-17 19:47   ` Kees Cook
2017-10-18  5:44     ` Kalle Valo
2017-10-18 19:45       ` Kees Cook
2017-10-18 11:42 ` David Miller
2017-10-18 19:42   ` Kees Cook

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=alpine.DEB.2.20.1710192328110.2054@nanos \
    --to=tglx@linutronix.de \
    --cc=davem@davemloft.net \
    --cc=gigaset307x-common@lists.sourceforge.net \
    --cc=isdn@linux-pingi.de \
    --cc=johan@kernel.org \
    --cc=keescook@chromium.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=netdev@vger.kernel.org \
    --cc=pebolle@tiscali.nl \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).