linux-kernel - Re: [linux-usb-devel] 2.6.19-rc5-mm1

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <Pine.LNX.4.44L0.0611091655080.2262-100000@iolanthe.rowland.org>
Date:	Thu, 9 Nov 2006 16:58:31 -0500 (EST)
From:	Alan Stern <stern@...land.harvard.edu>
To:	Andrew Morton <akpm@...l.org>,
	Benoit Boissinot <bboissin@...il.com>,
	Mattia Dongili <malattia@...ux.it>
cc:	USB development list <linux-usb-devel@...ts.sourceforge.net>,
	Kernel development list <linux-kernel@...r.kernel.org>,
	SCSI development list <linux-scsi@...r.kernel.org>
Subject: Re: [linux-usb-devel] 2.6.19-rc5-mm1

On Thu, 9 Nov 2006, Mattia Dongili wrote:

> On Thu, Nov 09, 2006 at 11:04:53AM -0800, Andrew Morton wrote:
> > 
> > (added linux-scsi)
> [...]
> > > [27526.232000] EIP: [<e8074e26>]
> > > scsi_device_dev_release_usercontext+0x36/0x100 [scsi_mod] SS:ESP
> > > 0068:dfdb1e3c
> > > 
> > > full dmesg attached, I can test patches and provide any useful
> > > information if needed (just not now because the dock is at work).
> > 
> > You're the second or third person to report this (to no effect, btw). 
> 
> oh, great. I was going to report the same (had with usb key unplug).
> Linux version 2.6.19-rc5-mm1-1 (mattia@...amune) (gcc version 4.1.2 20060901 (prerelease) (Debian 4.1.1-13)) #4 SMP Wed Nov 8 22:46:11 CET 2006

I don't know exactly where the problem lies, but I have narrowed it down.

In drivers/scsi/sd.c:sd_probe(), the call to add_disk() increases the 
device's refcount by 1.  However in sd_remove(), the call to del_gendisk() 
decreases the device's refcount by 2.  Consequently the structure is 
deallocated too early, causing the oops.

Somebody who knows more than I do about add_disk() and del_gendisk() will 
have to figure what's going wrong.

Alan Stern

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/