linux-kernel - Re: [BUG: 2.6.22-rc2] SLAB doesn't like usb_get

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <1447.81.207.0.53.1179612647.squirrel@secure.samage.net>
Date:	Sun, 20 May 2007 00:10:47 +0200 (CEST)
From:	"Indan Zupancic" <indan@....nu>
To:	"Greg KH" <greg@...ah.com>
Cc:	"Christoph Lameter" <clameter@....com>,
	"Linux Kernel Mailing List" <linux-kernel@...r.kernel.org>
Subject: Re: [BUG: 2.6.22-rc2] SLAB doesn't like usb_get_configuration()

On Sat, May 19, 2007 21:33, Greg KH wrote:
> On Sat, May 19, 2007 at 11:20:44AM -0700, Christoph Lameter wrote:
>> On Sat, 19 May 2007, Indan Zupancic wrote:
>>
>> > I had two SLAb related bugs, both with usb_get_configuration()
>> > near the end of the backtrace. First one was with git between
>> > rc1 and rc2, but very close to rc2, second one was with rc2,
>> > both at bootup.
>>
>> Well usb_get_configuration seems to do a kmalloc(0) which is a bit
>> strange and this is why we flagged the allocation in the slab allocators.
>> Is there some way to avoid allocating an object of zero length?
>
> Can you try the patch below and let me know if it fixes the issue for
> you or not?
>
> thanks,
>
> greg k-h
>
>
> From: Alan Stern <stern@...land.harvard.edu>
> Subject: [PATCH] USB: don't try to kzalloc 0 bytes
>
> This patch (as907) prevents us from trying to allocate 0 bytes
> when an interface has no endpoint descriptors.
>
> Signed-off-by: Alan Stern <stern@...land.harvard.edu>
>
> --- usb-2.6.orig/drivers/usb/core/config.c
> +++ usb-2.6/drivers/usb/core/config.c
> @@ -185,10 +185,12 @@ static int usb_parse_interface(struct de
>  		num_ep = USB_MAXENDPOINTS;
>  	}
>
> -	len = sizeof(struct usb_host_endpoint) * num_ep;
> -	alt->endpoint = kzalloc(len, GFP_KERNEL);
> -	if (!alt->endpoint)
> -		return -ENOMEM;
> +	if (num_ep > 0) {	/* Can't allocate 0 bytes */
> +		len = sizeof(struct usb_host_endpoint) * num_ep;
> +		alt->endpoint = kzalloc(len, GFP_KERNEL);
> +		if (!alt->endpoint)
> +			return -ENOMEM;
> +	}
>
>  	/* Parse all the endpoint descriptors */
>  	n = 0;
>

Thanks, this one seems to fix it, I don't get the BUG anymore.

Greetings,

Indan


-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/