linux-kernel - Re: Kernel oops with bluetooth usb dongle

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <alpine.LFD.1.00.0802200108040.7583@apollo.tec.linutronix.de>
Date:	Wed, 20 Feb 2008 01:14:06 +0100 (CET)
From:	Thomas Gleixner <tglx@...utronix.de>
To:	Marcel Holtmann <marcel@...tmann.org>
cc:	Quel Qun <kelk1@...cast.net>, LKML <linux-kernel@...r.kernel.org>,
	Jiri Kosina <jkosina@...e.cz>, Ingo Molnar <mingo@...e.hu>
Subject: Re: Kernel oops with bluetooth usb dongle

On Tue, 19 Feb 2008, Marcel Holtmann wrote:
> > > hci_cmd_task: hci0 command tx timeout
> > > BUG: unable to handle kernel paging request at 6b6b6b6b
> > 
> > We got some more info ---------------------------^^^^^^^^
> > #define POISON_FREE      0x6b    /* for use-after-free poisoning */
> > 
> > So the timer is in an allocated data structure, which is
> > freed without having removed the timer first.
> > 
> > > Sorry for the meager yield.
> > 
> > Hey, we know already more :)
> > 
> > Marcel, any idea on this one ?
> 
> I don't really have any idea. Nothing has been changed in this area for a
> couple of years. The command TX timeout is the timeout that indicates a
> missing answer to a command sent down to the Bluetooth chip.
> 
> However this involves some atomic and tasklet stuff. Did we have some changes
> that I missed and might now render this usage as broken.

Not that I'm aware off, but this might as well be some old use after
free bug which got exposed by some unrelated change. The good news is
that it is reproducible. I'll hack up some nasty debug patch which
lets us - hopefully - decode where the timer was armed.

Thanks,

	tglx
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/