linux-kernel - Re: [REGRESSION] 2.6.24/25: random lockups when accessing external USB harddrive

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <486269AE.7050006@nokia.com>
Date:	Wed, 25 Jun 2008 18:52:14 +0300
From:	Stefan Becker <Stefan.Becker@...ia.com>
To:	ext Alan Stern <stern@...land.harvard.edu>,
	linux-kernel@...r.kernel.org, linux-usb@...r.kernel.org
Subject: Re: [REGRESSION] 2.6.24/25: random lockups when accessing external
 USB harddrive

Hi,

ext Alan Stern wrote:
> On Tue, 24 Jun 2008, Stefan Becker wrote:
> 
>> So the lockup is caused by an already locked hcd_urb_list_lock. Is there 
>> a way to see the lock holder? Or any other suggestions how to proceed?
> 
> Good work!

Well, I guess I'm just lucky it didn't turn into a heisenbug with all 
those printk's in the code :-)

> The usage in usb_hcd_link_urb_to_ep() appears benign; the code doesn't 
> do anything that might hang while holding the lock.  All it does is 
> manipulate a linked list.

Unfortunately I could only run a small test today. I added some simple 
debugging code for the spinlock usage in hcd.c (see attached diff) and I 
get the following message at lockup (I tried it twice just to be sure):

HCD URB list locked by usb_hcd_link_urb_to_ep!

As far as I understand the matter this only can happen if 
usb_hcd_link_urb_to_ep() gets interrupted while holding the spinlock. 
But according to the contract at the header of the function it should be 
called with interrupts disabled!

I guess the obvious way forward from here is:

  - replace the spin_lock() in the function with the irqsave version

  - if that fixes the problem add debugging code to the function and 
panic with a stack trace when the interrupts aren't disabled one entry 
(don't know how to detect that yet, any suggestions?) That hopefully 
identifies the culprit that calls the function with interrupts enabled.

Regards,

	Stefan

---
Stefan Becker
E-Mail: Stefan.Becker@...ia.com

View attachment "hcd.c.debug-patch" of type "text/plain" (2005 bytes)