Re: [PATCH] net/cdc_ncm: fix null pointer panic at usbnet_link_change

2013-10-31 Thread Bjørn Mork
"Du, ChangbinX" writes: >> From: Bjørn Mork [mailto:bj...@mork.no] >> Sent: Tuesday, October 29, 2013 4:41 PM >> To: Du, ChangbinX >> Cc: oli...@neukum.org; linux-usb@vger.kernel.org; net...@vger.kernel.org; >> linux-ker...@vger.kernel.org >> Subj

RE: [PATCH] net/cdc_ncm: fix null pointer panic at usbnet_link_change

2013-10-30 Thread Du, ChangbinX
> From: Bjørn Mork [mailto:bj...@mork.no] > Sent: Tuesday, October 29, 2013 4:41 PM > To: Du, ChangbinX > Cc: oli...@neukum.org; linux-usb@vger.kernel.org; net...@vger.kernel.org; > linux-ker...@vger.kernel.org > Subject: Re: [PATCH] net/cdc_ncm: fix null pointer panic at

Re: [PATCH] net/cdc_ncm: fix null pointer panic at usbnet_link_change

2013-10-30 Thread Bjørn Mork
David Miller writes: > The problem is in cdc_ncm_bind_common(). > > It seems to leave dangling interface data pointers in some cases, and > then branches just to "error" so that they don't get cleared back out. Sorry, but I fail to see this as well. I see one "return" and two "goto error", but

Re: [PATCH] net/cdc_ncm: fix null pointer panic at usbnet_link_change

2013-10-29 Thread David Miller
From: "Du, ChangbinX" Date: Tue, 29 Oct 2013 03:30:42 + > In cdc_ncm_bind() function, it call cdc_ncm_bind_common() to setup usb. > But cdc_ncm_bind_common() may meet error and cause usbnet_disconnect() > be called which calls free_netdev(net). Thus usbnet structure(alloced > with net_device

Re: [PATCH] net/cdc_ncm: fix null pointer panic at usbnet_link_change

2013-10-29 Thread Bjørn Mork
"Du, ChangbinX" writes: > From: "Du, Changbin" > > In cdc_ncm_bind() function, it call cdc_ncm_bind_common() to setup usb. > But cdc_ncm_bind_common() may meet error and cause usbnet_disconnect() > be called which calls free_netdev(net). I am sure you are right, but I really don't see how that