linux-kernel - Re: Null Pointer BUG in uhci

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <200907081138.39211.lkml@morethan.org>
Date:	Wed, 8 Jul 2009 11:38:36 -0500
From:	"Michael S. Zick" <lkml@...ethan.org>
To:	Alan Stern <stern@...land.harvard.edu>
Cc:	Oliver Neukum <oliver@...kum.org>, Jiri Kosina <jkosina@...e.cz>,
	linux-kernel@...r.kernel.org, linux-usb@...r.kernel.org
Subject: Re: Null Pointer BUG in uhci_hcd

On Wed July 8 2009, Michael S. Zick wrote:
> On Wed July 8 2009, Michael S. Zick wrote:
> > On Tue July 7 2009, Alan Stern wrote:
> > > On Tue, 7 Jul 2009, Michael S. Zick wrote:
> > > 
> > > > On Tue July 7 2009, Alan Stern wrote:
> > > > > On Tue, 7 Jul 2009, Michael S. Zick wrote:
> > > > > 
> > > > > > > It looks like there's a serious problem in your UHCI hardware.  
> > > > > > > According to the log you posted, it's not working at all.
> > > > > > > 
> > > > > > 
> > > > > > I am using the x86-generic drivers - -
> > > > > 
> > > > > Not a problem with the drivers, a problem in the hardware.
> > > > > 
> > > > 
> > > > Or hardware that works as the manufacturer intended, but differently
> > > > than expected.  Same difference as "broken" when compared to "standard".
> > > 
> > > No, hardware that doesn't work at all.  As in "all reads return
> > > 0xffffffff" -- that's just a guess but something like it would account
> > > for what you saw.
> > > 

I tried to combine the addition of the diagnostic print (BUG())
statements and the potential fix - -
This is what I put into the code for today's testing:

diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
index be86ae3..d686f1d 100644
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -160,8 +160,10 @@ static inline char *portspeed(int portstatus)
 }

 /* Note that hdev or one of its children must be locked! */
-static inline struct usb_hub *hdev_to_hub(struct usb_device *hdev)
+static struct usb_hub *hdev_to_hub(struct usb_device *hdev)
 {
+       if (!hdev || !hdev->actconfig)
+               return NULL;
        return usb_get_intfdata(hdev->actconfig->interface[0]);
 }

@@ -369,11 +371,16 @@ static void kick_khubd(struct usb_hub *hub)
 {
        unsigned long   flags;

-       /* Suppress autosuspend until khubd runs */
-       to_usb_interface(hub->intfdev)->pm_usage_cnt = 1;
+       if (!hub) {
+               BUG();
+               return;
+       }

        spin_lock_irqsave(&hub_event_lock, flags);
        if (!hub->disconnected && list_empty(&hub->event_list)) {
+               /* Suppress autosuspend until khubd runs */
+               to_usb_interface(hub->intfdev)->pm_usage_cnt = 1;
+
                list_add_tail(&hub->event_list, &hub_event_list);
                wake_up(&khubd_wait);
        }
@@ -382,8 +389,19 @@ static void kick_khubd(struct usb_hub *hub)

 void usb_kick_khubd(struct usb_device *hdev)
 {
-       /* FIXME: What if hdev isn't bound to the hub driver? */
-       kick_khubd(hdev_to_hub(hdev));
+       struct usb_hub *hub;
+
+       if (!hdev) {
+               BUG();
+               return;
+       }
+       hub = hdev_to_hub(hdev);
+       if (hub) {
+               kick_khubd(hub);
+       } else {
+               BUG();
+               return;
+       }
 }

Mike
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/