Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1757706AbdLVKaY (ORCPT ); Fri, 22 Dec 2017 05:30:24 -0500 Received: from mail.linuxfoundation.org ([140.211.169.12]:34664 "EHLO mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751246AbdLVIxV (ORCPT ); Fri, 22 Dec 2017 03:53:21 -0500 From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Hayes Wang , "David S. Miller" , Sasha Levin Subject: [PATCH 4.9 012/104] r8152: fix the list rx_done may be used without initialization Date: Fri, 22 Dec 2017 09:45:38 +0100 Message-Id: <20171222084610.158157837@linuxfoundation.org> X-Mailer: git-send-email 2.15.1 In-Reply-To: <20171222084609.262099650@linuxfoundation.org> References: <20171222084609.262099650@linuxfoundation.org> User-Agent: quilt/0.65 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1159 Lines: 37 4.9-stable review patch. If anyone has any objections, please let me know. ------------------ From: hayeswang [ Upstream commit 98d068ab52b4b11d403995ed14154660797e7136 ] The list rx_done would be initialized when the linking on occurs. Therefore, if a napi is scheduled without any linking on before, the following kernel panic would happen. BUG: unable to handle kernel NULL pointer dereference at 000000000000008 IP: [] r8152_poll+0xe1e/0x1210 [r8152] PGD 0 Oops: 0002 [#1] SMP Signed-off-by: Hayes Wang Signed-off-by: David S. Miller Signed-off-by: Sasha Levin Signed-off-by: Greg Kroah-Hartman --- drivers/net/usb/r8152.c | 1 + 1 file changed, 1 insertion(+) --- a/drivers/net/usb/r8152.c +++ b/drivers/net/usb/r8152.c @@ -1362,6 +1362,7 @@ static int alloc_all_mem(struct r8152 *t spin_lock_init(&tp->rx_lock); spin_lock_init(&tp->tx_lock); INIT_LIST_HEAD(&tp->tx_free); + INIT_LIST_HEAD(&tp->rx_done); skb_queue_head_init(&tp->tx_queue); skb_queue_head_init(&tp->rx_queue);