linux-kernel - Re: S2R resume crash in 2.6.33-rc7 - NULL pointer dereference in dev_get

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Sat, 13 Feb 2010 19:36:09 +0100
From:	Bruno Prémont <bonbons@...ux-vserver.org>
To:	Alan Stern <stern@...land.harvard.edu>
Cc:	Jiri Kosina <jkosina@...e.cz>, Oliver Neukum <oliver@...kum.org>,
	Stephen Rothwell <sfr@...b.auug.org.au>,
	Marcel Holtmann <marcel@...tmann.org>,
	H Hartley Sweeten <hsweeten@...ionengravers.com>,
	<linux-usb@...r.kernel.org>, <linux-input@...r.kernel.org>,
	<linux-kernel@...r.kernel.org>
Subject: Re: S2R resume crash in 2.6.33-rc7 - NULL pointer dereference in
 dev_get_drvdata() for usbhid

On Sat, 13 February 2010 Alan Stern <stern@...land.harvard.edu> wrote:
>
> On Sat, 13 Feb 2010, Bruno [UTF-8] Prémont wrote:
> 
> > On Mon, 08 February 2010 Alan Stern <stern@...land.harvard.edu>
> > wrote:
> > > Clearly something is setting usbhid->intf to NULL.  But I don't
> > > see any code that would do it.  You may have to resort to putting
> > > printk() statements at various strategic places to find out where
> > > it happens. You could start with the beginnings and ends of
> > > hid_suspend, hid_resume, and hid_reset_resume.  Maybe also
> > > usbhid_disconnect(), just in case.
> > 
> > I did add a few printk()s and WARN_ON()s to get a better idea of
> > why/when usbhid->intf is NULL and it is already since probe time of
> > the second interface anounced by the USB keyboard (hid.debug=1):
> 
> ...
> 
> > This lets me guess that hid_add_device() is doing something wrong
> > here when report parsing fails... (as that one is the only one which
> > could be doing the initialization of usbhid which does work for the
> > first interface announced by my keyboard)
> 
> I don't know about doing anything wrong...  However it does appear
> that in this case the interface is registered on the HID bus but
> doesn't get bound to a driver.  Jiri will know whether or not that's
> the desired outcome.
> 
> On the other hand, I don't think there would be anything wrong with 
> moving the
> 
> 	usbhid->intf = intf;
> 	usbhid->ifnum = interface->desc.bInterfaceNumber;
> 
> lines from usbhid_start() to usbhid_probe(), just before the call to
> hid_add_device().  It should fix the bug, and those lines do belong in
> the probe routine.  Jiri, any problems with doing this?

With the below patch (which is only half of the move work) I don't
get crashes anymore. Though I wonder if other initialization steps
(like the spin_lock_init() right before setting usbhid->intf) would
need to be moved as well.

Bruno

diff --git a/drivers/hid/usbhid/hid-core.c b/drivers/hid/usbhid/hid-core.c
index e2997a8..690ca75 100644
--- a/drivers/hid/usbhid/hid-core.c
+++ b/drivers/hid/usbhid/hid-core.c
@@ -1154,6 +1154,8 @@ static int usbhid_probe(struct usb_interface *intf, const struct usb_device_id *
 
 	hid->driver_data = usbhid;
 	usbhid->hid = hid;
+	usbhid->intf = intf;
+	usbhid->ifnum = interface->desc.bInterfaceNumber;
 
 	ret = hid_add_device(hid);
 	if (ret) {
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/