linux-kernel - Re: ehci splatter in 2.6.26-rc2

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-Id: <200805140611.45897.david-b@pacbell.net>
Date:	Wed, 14 May 2008 06:11:45 -0700
From:	David Brownell <david-b@...bell.net>
To:	Lennert Buytenhek <buytenh@...tstofly.org>
Cc:	linux-kernel@...r.kernel.org, Nicolas Pitre <nico@....org>,
	Sylver Bruneau <sylver.bruneau@...glemail.com>,
	Byron Bradley <byron.bbradley@...il.com>,
	Martin Michlmayr <tbm@...ius.com>
Subject: Re: ehci splatter in 2.6.26-rc2

On Wednesday 14 May 2008, Lennert Buytenhek wrote:
> On 2.6.26-rc2, plugging in a certain USB device (haven't tested yet
> with other devices) gives me (on two different ARM boards) the oops
> below.
> 
> Anyone else seeing the same?

I have no ARM running EHCI, but I can report it's OK
for me on x86 (limited testing) ... I'd expect to have
heard *very* load screams by now if this was common.


> usb 1-1: new low speed USB device using orion-ehci and address 2
> Unable to handle kernel NULL pointer dereference at virtual address 00000000
> pgd = c0004000
> [00000000] *pgd=00000000
> Internal error: Oops: 17 [#1] PREEMPT
> Modules linked in:
> CPU: 0    Not tainted  (2.6.26-rc2 #340)
> PC is at qh_append_tds+0x24c/0x44c
> LR is at ehci_qtd_alloc+0x30/0x5c
> ...
> [<c0223668>] (qh_append_tds+0x0/0x44c) from [<c0225470>]
>		(ehci_urb_enqueue+0x100 /0xfb8) 
> [<c0225370>] (ehci_urb_enqueue+0x0/0xfb8) from [<c02163e8>]
>		(usb_hcd_submit_urb+ 0x824/0x91c) 

Nothing in that vicinity should have changed in ages,
which makes me wonder if it's really EHCI which is
triggering this.

The only thing coming vaguely to mind is that this may
have to do with dma-coherent memory allocations.  If
the platform support for that has any goofage, you might
be able to elicit different behaviors with dmapool debug
(enable CONFIG_DEBUG_SLAB or CONFIG_SLUB_DEBUG_ON).

- Dave



--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/