linux-kernel - Re: 2.6.18.5 usb/sysfs bug.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:	Sun, 17 Dec 2006 02:43:35 -0500
From:	Chuck Ebbert <76306.1226@...puserve.com>
To:	Dave Jones <davej@...hat.com>
Cc:	linux-kernel@...r.kernel.org, Greg KH <greg@...ah.com>
Subject: Re: 2.6.18.5 usb/sysfs bug.

In-Reply-To: <20061216141828.GA23368@...hat.com>

On Sat, 16 Dec 2006 09:18:28 -0500, Dave Jones wrote:

>  > That's strange.  Remove_files called sysfs_hash_and_remove()
>  > with dir==0xfffffff3 (-13 decimal.)
> 
> Hmm, That's -EACCESS.  Something not checking a return code at a lower
> level maybe ?

In fs/sysfs/group.c:

void sysfs_remove_group(struct kobject * kobj,
                        const struct attribute_group * grp)
{
        struct dentry * dir;

        if (grp->name)
                dir = lookup_one_len(grp->name, kobj->dentry,
                                strlen(grp->name));
        else
                dir = dget(kobj->dentry);

        remove_files(dir,grp);
        if (grp->name)
                sysfs_remove_subdir(dir);
        /* release the ref. taken in this routine */
        dput(dir);
}

'dir' is being used without checking whether lookup_one_len()
succeeded.

> It's odd that something disconnects during boot, as nothing gets plugged.

Sometimes notebooks have USB devices built-in and they get treated
as if they were hotplugged.

-- 
MBTI: IXTP

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/