linux-kernel - Re: [USB boot crash, -git] ecm_do_notify(), list_add corruption. prev->next should be next (ffff88003b8f82f8)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Wed, 23 Jul 2008 23:46:55 -0400 (EDT)
From:	Alan Stern <stern@...land.harvard.edu>
To:	David Brownell <david-b@...bell.net>
cc:	Ingo Molnar <mingo@...e.hu>, Greg KH <gregkh@...e.de>,
	<linux-kernel@...r.kernel.org>, <linux-usb@...r.kernel.org>,
	"Rafael J. Wysocki" <rjw@...k.pl>
Subject: Re: [USB boot crash, -git] ecm_do_notify(), list_add corruption.
 prev->next should be next (ffff88003b8f82f8)

On Wed, 23 Jul 2008, David Brownell wrote:

> So far, the fingers point at dummy_hcd... the merge doesn't
> seem to have had problems, and the gadget driver had been
> tested with four different peripheral controller drivers
> (pre-merge).

> But the link state notification (probably using ep-e) message
> couldn't be queued (list_add_tail) because of this oopsing:
> 
> 
> > usb0: qlen 10
> > g_cdc gadget: notify connect false
> > list_add corruption. prev->next should be next (ffff88003b8f82f8), but was ffff88003b8f8e80. (prev=ffff88003b8f8e80).
> 
> Now, prev->next == prev is expected here:  that list of messages
> should be empty.
> 
> What's wrong is that head->prev != head, meaning something
> trashed a dummy_hcd data structure.

The problem could easily be that dummy-hcd simply isn't 
list-debugging-safe.  I wouldn't be at all surprised if, for example, 
it adds a node to a list without initializing the node first.

Alan Stern

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/