netdev - HSO driver patch [1/2]

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 7 Oct 2016 16:29:42 +0200
From:   Matej Kupljen <matej.kupljen@...il.com>
To:     Greg KH <gregkh@...uxfoundation.org>
Cc:     linux-usb@...r.kernel.org, netdev@...r.kernel.org
Subject: HSO driver patch [1/2]

Hi,


I am using hso driver for my 3G modem (although different manufacturer
with different USB VID/PID) but I have some problems with it. It is
working fine, but if you disconnect the USB connection while the data
is transferring trough AT interface, we get a crash.

There are two patches:
 1.) 0001-Reverse-the-order-in-disconnect.patch
      This patch first sets the interface to NULL and only then starts
removing the allocated
      resources. This is according to documentation and it is also
more similar to other drivers.
 2.) 0002-Stop-also-serial-queue-when-device-is-unplugged.patch
      Serial device was not stopped when the device got unplugged so
there are continues error
      messages that the URB cannot be submitted.

Another problem is that we can hit the WARN macro in hso_serial_open by:
1.) Plug in the USB modem
2.) Load hso.ko module
3.) Create the /dev nodes
4.) do a less -f /dev/ttyHS2
5.) unplug the USB modem
6.) Re-plug it and back
7.) Quit previous less by pressing q
8.) start less again like in 4 and you'll get

[  198.828136] ------------[ cut here ]------------
[  198.832788] WARNING: CPU: 2 PID: 1799 at include/linux/kref.h:47
kobject_get+0x9c/0xa8()
[  198.840886] Modules linked in: hso
[  198.844337] CPU: 2 PID: 1799 Comm: less Not tainted
4.1.13-00130-g126c250-dirty #5
[  198.851917] Hardware name: Freescale i.MX6 Quad/DualLite (Device Tree)
[  198.858481] [<80017b70>] (unwind_backtrace) from [<800137d0>]
(show_stack+0x10/0x14)
[  198.866246] [<800137d0>] (show_stack) from [<8063caa0>]
(dump_stack+0x84/0xc4)
[  198.873492] [<8063caa0>] (dump_stack) from [<8002857c>]
(warn_slowpath_common+0x84/0xb4)
[  198.881597] [<8002857c>] (warn_slowpath_common) from [<80028648>]
(warn_slowpath_null+0x1c/0x24)
[  198.890398] [<80028648>] (warn_slowpath_null) from [<802533a8>]
(kobject_get+0x9c/0xa8)
[  198.898420] [<802533a8>] (kobject_get) from [<80110b90>] (cdev_get+0x2c/0x4c)
[  198.905571] [<80110b90>] (cdev_get) from [<80110eb0>]
(chrdev_open+0x2c/0x178)
[  198.912812] [<80110eb0>] (chrdev_open) from [<8010aff0>]
(do_dentry_open+0x1d8/0x2f8)
[  198.920666] [<8010aff0>] (do_dentry_open) from [<80118958>]
(do_last+0x564/0xce4)
[  198.928164] [<80118958>] (do_last) from [<8011b0fc>] (path_openat+0x80/0x5cc)
[  198.935330] [<8011b0fc>] (path_openat) from [<8011c0f8>]
(do_filp_open+0x2c/0x88)
[  198.942832] [<8011c0f8>] (do_filp_open) from [<8010c36c>]
(do_sys_open+0x108/0x1cc)
[  198.950508] [<8010c36c>] (do_sys_open) from [<80010140>]
(ret_fast_syscall+0x0/0x60)
[  198.958292] ---[ end trace d0b32f14e1047616 ]---

Thanks,
Matej

View attachment "0001-Reverse-the-order-in-disconnect.patch" of type "text/x-patch" (981 bytes)