linux-kernel - Re: USB OOPS 2.6.25-rc2-git1

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <200802201454.52125.david-b@pacbell.net>
Date:	Wed, 20 Feb 2008 14:54:51 -0800
From:	David Brownell <david-b@...bell.net>
To:	Alan Stern <stern@...land.harvard.edu>
Cc:	Andre Tomt <andre@...t.net>,
	Kernel development list <linux-kernel@...r.kernel.org>,
	USB list <linux-usb@...r.kernel.org>
Subject: Re: USB OOPS 2.6.25-rc2-git1

On Wednesday 20 February 2008, Alan Stern wrote:
> On Wed, 20 Feb 2008, David Brownell wrote:
> 
> > On Wednesday 20 February 2008, Alan Stern wrote:
> > > > ehci_hcd 0000:00:1d.7: IAA watchdog, lost IAA: status 8029 cmd 10021
> > > 
> > > lines in the log brings up some ideas that have been percolating in my 
> > > mind for a while.  They have to do with the possibility of a race 
> > > between the watchdog routine and assertion of IAA.
> > 
> > The curious bit IMO being STS_INT (0001), which should also have
> > triggered an IRQ.  Suggesting to me that the race might be lower
> > level than that ... at the level of a conflict between the various
> > mechanisms to ack irqs.
> 
> Maybe it did trigger an IRQ.  Inside the watchdog routine interrupts 
> are disabled.
> 
> > > In fact, if the timing comes out just wrong then it's possible (on SMP
> > > systems) for an IAA interrupt to arrive when the watchdog
> > > routine has already started running.  Then end_unlink_async() might get 
> > > called right at the start of a new IAA cycle, or when the reclaim list 
> > > is empty.
> > 
> > The driver's spinlock should prevent that particular problem from
> > appearing.
> 
> I don't think so:
> 
> 	CPU 0				CPU 1
> 	-----				-----
> 	Watchdog timer expires
> 	Timer routine acquires spinlock
> 					IAA IRQ arrives
> 					ehci_irq tries to acquire 
> 						spinlock...

There's another condition here, and
another action.  The condition is
that ehci->reclaim must first be set;
the action is to clear STS_IAA (and,
given the previous patch, maybe IAAD).

And this "either" is more concisely
written as "call end_unlink_async()"
(point made just for clarity).

> 	Timer routine either sets
> 		ehci->reclaim to NULL 
> 		or else starts a new
> 		IAA cycle
> 	Timer routine releases spinlock
> 		and returns
> 					ehci_irq acquires spinlock
> 						and sees IAA is set

					Can only happen if a new IAA
					cycle was started by CPU0, and
					the IAA condition triggered
					that quickly.

> 					Call end_unlink_async()!
> 
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/