linux-kernel - Re: S2R resume crash in 2.6.33-rc7 - NULL pointer dereference in dev_get

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:	Wed, 17 Feb 2010 14:24:09 +0100 (CET)
From:	Jiri Kosina <jkosina@...e.cz>
To:	Bruno Prémont <bonbons@...ux-vserver.org>
Cc:	Alan Stern <stern@...land.harvard.edu>,
	Oliver Neukum <oliver@...kum.org>,
	Stephen Rothwell <sfr@...b.auug.org.au>,
	Marcel Holtmann <marcel@...tmann.org>,
	H Hartley Sweeten <hsweeten@...ionengravers.com>,
	linux-usb@...r.kernel.org, linux-input@...r.kernel.org,
	linux-kernel@...r.kernel.org
Subject: Re: S2R resume crash in 2.6.33-rc7 - NULL pointer dereference in
 dev_get_drvdata() for usbhid

On Sat, 13 Feb 2010, Bruno Prémont wrote:

> > > This lets me guess that hid_add_device() is doing something wrong
> > > here when report parsing fails... (as that one is the only one which
> > > could be doing the initialization of usbhid which does work for the
> > > first interface announced by my keyboard)
> > 
> > I don't know about doing anything wrong...  However it does appear
> > that in this case the interface is registered on the HID bus but
> > doesn't get bound to a driver.  Jiri will know whether or not that's
> > the desired outcome.
> > 
> > On the other hand, I don't think there would be anything wrong with 
> > moving the
> > 
> > 	usbhid->intf = intf;
> > 	usbhid->ifnum = interface->desc.bInterfaceNumber;
> > 
> > lines from usbhid_start() to usbhid_probe(), just before the call to
> > hid_add_device().  It should fix the bug, and those lines do belong in
> > the probe routine.  Jiri, any problems with doing this?
> 
> With the below patch (which is only half of the move work) I don't
> get crashes anymore. Though I wonder if other initialization steps
> (like the spin_lock_init() right before setting usbhid->intf) would
> need to be moved as well.
> 
> Bruno
> 
> diff --git a/drivers/hid/usbhid/hid-core.c b/drivers/hid/usbhid/hid-core.c
> index e2997a8..690ca75 100644
> --- a/drivers/hid/usbhid/hid-core.c
> +++ b/drivers/hid/usbhid/hid-core.c
> @@ -1154,6 +1154,8 @@ static int usbhid_probe(struct usb_interface *intf, const struct usb_device_id *
>  
>  	hid->driver_data = usbhid;
>  	usbhid->hid = hid;
> +	usbhid->intf = intf;
> +	usbhid->ifnum = interface->desc.bInterfaceNumber;
>  
>  	ret = hid_add_device(hid);
>  	if (ret) {
> 

Thanks for beating me with looking into this guys.

I have pushed fix for this into for-next branch, so it should appear in 
tomorrow linux-next pile. If you still experience the problem, please let 
me know.

Thanks,

-- 
Jiri Kosina
SUSE Labs, Novell Inc.
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/