linux-kernel - Re: [GIT] HID updates for 2.6.29

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Tue, 6 Jan 2009 16:57:07 -0800 (PST)
From:	Linus Torvalds <torvalds@...ux-foundation.org>
To:	Gabriel C <nix.or.die@...glemail.com>
cc:	Jiri Kosina <jkosina@...e.cz>, linux-kernel@...r.kernel.org
Subject: Re: [GIT] HID updates for 2.6.29



On Wed, 7 Jan 2009, Gabriel C wrote:
> 
> After this merge I get the following panic , by just touching my  Wireless USB Mouse :
> 
> ...
> 
> [  223.999461] BUG: unable to handle kernel NULL pointer dereference at 0000000000000050
> [  224.000446] IP: [<ffffffff80224e65>] __ticket_spin_lock+0x9/0x1a
> [  224.000446] PGD 7b4a5067 PUD 7a24b067 PMD 0
> [  224.000446] Oops: 0002 [#1] PREEMPT SMP
> [  224.000446] last sysfs file: /sys/devices/pci0000:00/0000:00:19.0/irq
> [  224.000446] CPU 0
> [  224.000446] Modules linked in: i915 binfmt_misc acpi_cpufreq freq_table w83627ehf hwmon_vid fuse loop lp ppdev parport_pc parport joydev pcspkr i2c_i801 intel_agp button sg evdev processor
> [  224.000446] Pid: 0, comm: swapper Not tainted 2.6.28-06127-g238c6d5 #31
> [  224.000446] RIP: 0010:[<ffffffff80224e65>]  [<ffffffff80224e65>] __ticket_spin_lock+0x9/0x1a
> [  224.000446] RSP: 0018:ffffffff807e3bd0  EFLAGS: 00010002
> [  224.000446] RAX: 0000000000000100 RBX: 0000000000000082 RCX: 0000000000000000
> [  224.000446] RDX: 0000000000000000 RSI: 0000000000000082 RDI: 0000000000000050
> [  224.000446] RBP: ffffffff807e3bd0 R08: ffff88007d254000 R09: ffffffff806db440
> [  224.000446] R10: ffffffff8023d95c R11: ffff88007e0a3d80 R12: 0000000000000050
> [  224.000446] R13: ffffffff807e3c70 R14: 0000000000000006 R15: 0000000000000050
> [  224.000446] FS:  0000000000000000(0000) GS:ffffffff807ec000(0000) knlGS:0000000000000000
> [  224.000446] CS:  0010 DS: 0018 ES: 0018 CR0: 000000008005003b
> [  224.000446] CR2: 0000000000000050 CR3: 000000007e1c0000 CR4: 00000000000006e0
> [  224.000446] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
> [  224.000446] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
> [  224.000446] Process swapper (pid: 0, threadinfo ffffffff80772000, task ffffffff806d8340)
> [  224.000446] Stack:
> [  224.000446]  ffffffff807e3be0 ffffffff80224f2f ffffffff807e3c00 ffffffff805673a7
> [  224.000446]  ffff88007d22c180 0000000000000000 ffffffff807e3c50 ffffffff80496bc0
> [  224.000446]  ffff880001014740 ffff88000101af00 ffff88000101af00 ffff88007d22c180
> [  224.000446] Call Trace:
> [  224.000446]  <IRQ> <0> [<ffffffff80224f2f>] default_spin_lock_flags+0x9/0xe
> [  224.000446]  [<ffffffff805673a7>] _spin_lock_irqsave+0x37/0x40
> [  224.000446]  [<ffffffff80496bc0>] hiddev_send_event+0x2e/0xe9

Looks like "hiddev" is NULL in hiddev_send_event(), so then the

	spin_lock_irqsave(&hiddev->list_lock, flags);

does an offset from NULL, and tries to access memory at 0x0050.

> [  224.000446]  [<ffffffff80496ccd>] hiddev_report_event+0x52/0x54
> [  224.000446]  [<ffffffff8048cd93>] hid_report_raw_event+0xb3/0x3b3
> [  224.000446]  [<ffffffff8048d15c>] hid_input_report+0xc9/0xdc
> [  224.000446]  [<ffffffff80494939>] hid_irq_in+0x90/0x194
> [  224.000446]  [<ffffffff804535ef>] usb_hcd_giveback_urb+0x58/0x87
> [  224.000446]  [<ffffffff80469f0f>] uhci_giveback_urb+0x108/0x19d
> [  224.000446]  [<ffffffff8046a666>] uhci_scan_schedule+0x5a8/0x86b
> [  224.000446]  [<ffffffff8046c5bc>] uhci_irq+0x13f/0x158
> [  224.000446]  [<ffffffff80453168>] usb_hcd_irq+0x42/0x90
> [  224.000446]  [<ffffffff80278485>] handle_IRQ_event+0x2e/0x65
> [  224.000446]  [<ffffffff80279994>] handle_fasteoi_irq+0x8b/0xcb
> [  224.000446]  [<ffffffff8020f08c>] do_IRQ+0x70/0xe4
> [  224.000446]  [<ffffffff8020ce93>] ret_from_intr+0x0/0x29

Jiri?

		Linus
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/