linux-kernel - Re: [crash] af9005_usb_module_init(): BUG: unable to handle kernel paging request at ff100000

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20090203213245.GD20527@elte.hu>
Date:	Tue, 3 Feb 2009 22:32:45 +0100
From:	Ingo Molnar <mingo@...e.hu>
To:	Luca Olivetti <luca@...toso.org>
Cc:	Daniel Walker <dwalker@...o99.com>, Greg KH <gregkh@...e.de>,
	Mauro Carvalho Chehab <mchehab@...radead.org>,
	linux-kernel@...r.kernel.org, Hans Verkuil <hverkuil@...all.nl>,
	Janne Grunau <janne-dvb@...nau.be>
Subject: Re: [crash] af9005_usb_module_init(): BUG: unable to handle kernel
	paging request at ff100000


* Luca Olivetti <luca@...toso.org> wrote:

> En/na Ingo Molnar ha escrit:
>> * Daniel Walker <dwalker@...o99.com> wrote:
>>
>>> On Tue, 2009-02-03 at 18:28 +0100, Ingo Molnar wrote:
>>>> FYI, -tip qa keeps triggering this bootup crash occasionally, ever 
>>>> since June 2008 when a DVB merge brought in this new driver:
>>> It looks like it could be a config problem.. The crash happens around 
>>> these two symbol "af9005_rc_keys", and "af9005_rc_keys_size" , and 
>>> they are both defined inside af9005-remote.c different from where the 
>>> init functions is lcoated .. af9005-remote.c needs a special config  
>>> CONFIG_DVB_USB_AF9005_REMOTE to get compiled which you have 
>>> disabled..
>>
>> ok - but it shouldnt crash, obviously.
>
> Did you try my suggestion I sent the past December 26th?
> Quote:
>
> El Fri, 26 Dec 2008 11:08:33 -0200
> Mauro Carvalho Chehab <mchehab@...radead.org> escribió:
> > > Luca,
> > >
> > > Could you please verify this issue?
>
> No, I don't have 2.6.28, but I guess that maybe once usb_register is
> called the dvb-usb subsystem asynchronously (is that an smp system?)
> starts polling the remote before the rc_decode function pointer has been
> initialized.

Correct, and the bug triggered on a 'very SMP' system: a hyperthreading 
system that triggers SMP races much sooner than other (multi-core) SMP 
systems. It also triggered spuriously - i.e. not in a reproducible way.

> Could you try to initialize it to NULL before calling usb_register?

Sorry - there was no patch i think for me to try so i didnt try it. I'll try 
the patch in your next mail. Please queue your fix up for upstream and 
consider the bug fixed, unless i re-report it in a few days. Since it's a 
spurious crash there's no clear reproducer i can test.

	Ingo
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/