linux-kernel - Re: USB mass storage and ARM cache coherency

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <Pine.LNX.4.44L0.1002031011010.1540-100000@iolanthe.rowland.org>
Date:	Wed, 3 Feb 2010 10:15:45 -0500 (EST)
From:	Alan Stern <stern@...land.harvard.edu>
To:	Andreas Mohr <andi@...as.de>
cc:	Catalin Marinas <catalin.marinas@....com>,
	Oliver Neukum <oliver@...kum.org>,
	Matthew Dharm <mdharm-kernel@...-eyed-alien.net>,
	Sergei Shtylyov <sshtylyov@...mvista.com>,
	Ming Lei <tom.leiming@...il.com>, <linux-usb@...r.kernel.org>,
	linux-kernel <linux-kernel@...r.kernel.org>,
	Sebastian Siewior <bigeasy@...utronix.de>,
	Greg KH <greg@...ah.com>
Subject: Re: USB mass storage and ARM cache coherency

On Tue, 2 Feb 2010, Andreas Mohr wrote:

> Any ideas? To my uncaring mind this would look like __flush_dcache_page()
> not being quite so happy with a NULL pointer that it is being served
> (although I haven't managed to precisely investigate yet where the
> dereferencing offset 0000041c is coming from).
> 
> Yes, crash is reproducible (three times on boot already, although some bootup
> does make it successfully).
> 
> My ehci-q.c has:
> 
>        if (usb_pipein(urb->pipe) && usb_pipetype(urb->pipe) != PIPE_CONTROL) {
>                void *ptr;
>                for (ptr = urb->transfer_buffer;
>                     ptr < urb->transfer_buffer + urb->transfer_buffer_length;
>                     ptr += PAGE_SIZE)
>                        flush_dcache_page(virt_to_page(ptr));
>        }
> 
> Hmm, OTOH this code seems to postulate that urb->transfer_buffer_length
> is that 0x41c from above...
> (IOW the code is simply missing an urb->transfer_buffer NULL check)
> OTOH there would also be the question whether flush_dcache_page() should
> have caught the NULL pointer input...
> And then there's the question whether urb->transfer_buffer is allowed to end
> up as NULL anyway...

Have you looked at the code in qh_urb_transaction() in ehci-q.c
involving this_sg_len and buf?  It's quite possible that
urb->transfer_buffer is a NULL pointer and that the actual buffer is
not a contiguous set of pages -- but only if DMA is used.

Alan Stern

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/