Skip to content
Snippets Groups Projects
  1. Aug 30, 2013
    • Maxime Bizon's avatar
      firmware loader: fix pending_fw_head list corruption · 1eeeef15
      Maxime Bizon authored
      
      Got the following oops just before reboot:
      
      Unable to handle kernel NULL pointer dereference at virtual address 00000000
      [<8028d300>] (__list_del_entry+0x44/0xac)
      [<802e3320>] (__fw_load_abort.part.13+0x1c/0x50)
      [<802e337c>] (fw_shutdown_notify+0x28/0x50)
      [<80034f80>] (notifier_call_chain.isra.1+0x5c/0x9c)
      [<800350ec>] (__blocking_notifier_call_chain+0x44/0x58)
      [<80035114>] (blocking_notifier_call_chain+0x14/0x18)
      [<80035d64>] (kernel_restart_prepare+0x14/0x38)
      [<80035d94>] (kernel_restart+0xc/0x50)
      
      The following race condition triggers here:
      
        _request_firmware_load()
        device_create_file(...)
        kobject_uevent(...)
        (schedule)
                                             (resume)
                                             firmware_loading_store(1)
                                             firmware_loading_store(0)
                                             list_del_init(&buf->pending_list)
                                             (schedule)
        (resume)
        list_add(&buf->pending_list, &pending_fw_head);
        wait_for_completion(&buf->completion);
      
      causing an oops later when walking pending_list after the firmware has
      been released.
      
      The proposed fix is to move the list_add() before sysfs attribute
      creation.
      
      Signed-off-by: default avatarMaxime Bizon <mbizon@freebox.fr>
      Acked-by: default avatarMing Lei <ming.lei@canonical.com>
      Cc: stable <stable@vger.kernel.org>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      1eeeef15
  2. Aug 29, 2013
  3. Aug 28, 2013
  4. Aug 27, 2013
  5. Aug 26, 2013
  6. Aug 25, 2013
  7. Aug 24, 2013
  8. Aug 23, 2013
  9. Aug 22, 2013
Loading