linux-kernel - Re: WARNING: at drivers/usb/host/ehci-hcd.c:287

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Tue, 4 Mar 2008 11:29:58 -0500 (EST)
From:	Alan Stern <stern@...land.harvard.edu>
To:	David Brownell <david-b@...bell.net>,
	Christian Kujau <lists@...dbynature.de>
cc:	LKML <linux-kernel@...r.kernel.org>, <0x0007@...il.com>,
	USB list <linux-usb@...r.kernel.org>
Subject: Re: WARNING: at drivers/usb/host/ehci-hcd.c:287

On Mon, 3 Mar 2008, Christian Kujau wrote:

> On Mon, 3 Mar 2008, Christian Kujau wrote:
> > after upgrading to 2.6.25-rc3, kern.log shows:
> >
> > [ 1535.884848] ------------[ cut here ]------------
> > [ 1535.884855] WARNING: at drivers/usb/host/ehci-hcd.c:287
> 
> Hm, after ~24h of uptime, this message appeared 25 times already.
> The WLAN USB device was used the whole time, the usb-storage module
> was hardly used over the day:
> 
> # grep usb /proc/interrupts
>   10:   10693403    XT-PIC-XT        ohci_hcd:usb3, eth0
>   11:   10270770    XT-PIC-XT        sym53c8xx, ehci_hcd:usb1
>   12:         91    XT-PIC-XT        ohci_hcd:usb2
> 
> I even tried to trigger the system freeze[0] by using usb-storage
> and reading a lot from it, but no freeze, and the message could
> not be triggered either - they pop up every now and then, but too often, 
> IMHO.
> 
> Can anybody shed some light on this?

Dave, it seems to me that this must be an example of a race between the 
iaa watchdog timer expiring and end_unlink_async() running.  It's not 
good enough for end_unlink_async() to call iaa_watchdog_done(), because 
on an SMP system the timer may already have fired and the watchdog 
routine may be spinning on ehci->lock.

It's even worse, because end_unlink_async() can call 
start_unlink_async().  If that happens, the watchdog routine will think 
the timer has expired when in fact it has just been restarted.

How about replacing the

	WARN_ON(!ehci->reclaim);

line in ehci_iaa_watchdog() with

	if (unlikely(!ehci->reclaim || 
			!HC_IS_RUNNING(ehci_to_hcd(ehci)->state) ||
			timer_pending(&ehci->iaa_watchdog))
		goto done;

where "done:" is added just before the spin_unlock_irqrestore?

Alan Stern

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/