linux-kernel - Re: [REGRESSION, bisected] 2.6.36-rc1

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <alpine.LNX.2.00.1008180911180.1019@pobox.suse.cz>
Date:	Wed, 18 Aug 2010 09:13:40 +0200 (CEST)
From:	Jiri Kosina <jkosina@...e.cz>
To:	trapDoor <trapdoor6@...il.com>
Cc:	"Rafael J. Wysocki" <rjw@...k.pl>,
	LKML <linux-kernel@...r.kernel.org>, arnd@...db.de,
	trapDoor <trapdoor6@...glemail.com>
Subject: Re: [REGRESSION, bisected] 2.6.36-rc1 - suspend issues

On Wed, 18 Aug 2010, trapDoor wrote:

> >> Bisecting turned up the following commit. Reverting it in 2.6.36-rc1
> >> results in a system that works.
> >>
> >> commit bd25f4dd6972755579d0ea50d1a5ace2e9b00d1a
> >> Author: Arnd Bergmann <arnd@...db.de>
> >> Date:   Sun Jul 11 15:34:05 2010 +0200
> >>
> >>     HID: hiddev: use usb_find_interface, get rid of BKL
> >>
> >>     This removes the private hiddev_table in the usbhid
> >>     driver and changes it to use usb_find_interface
> >>     instead.
> >>
> >>     The advantage is that we can avoid the race between
> >>     usb_register_dev and usb_open and no longer need the
> >>     big kernel lock.
> >>
> >>     This doesn't introduce race condition -- the intf pointer could be
> >>     invalidated only in hiddev_disconnect() through usb_deregister_dev(),
> >>     but that will block on minor_rwsem and not actually remove the device
> >>     until usb_open().
> >> -----------------------
> >>
> >> Despite mentioned issues with network (occurring every time after
> >> unsuccessful suspend > hard restart) the bisecting turned up a commit
> >> which isn't rather related to network. But I can confirm that
> >> reverting only this one commit in 2.6.36-rc1
> >> [da5cabf80e2433131bf0ed8993abc0f7ea618c73] fixes the whole problem -
> >> suspend works OK and I have no issues with my network after waking the
> >> system up, neither after re-booting from the same or any other kernel.
> >>
> >> Please let me know what further details should I provide. Any logs,
> >> hardware specifications? I've also made a brief log recording the
> >> bisect if anyone would need it.
> >
> > Well, we should let the HID maintainer know about the problem (CC added).
> 
> Thanks Rafael,
> Before I opened this thread I only searched on
> http://vger.kernel.org/vger-lists.html for any appropriate mailing
> list but nothing linke linux-*hid* there. Now I've found out that
> there is a list of all maintainers included in the kernel source. I'll
> keep that in mind ..

Yeah, MAINTAINERS file is always good to consult. Also CCing all people 
who have Signed-off-by or Acked-by the offending patch is usually a good 
idea.

Could you please verify whether the patch below (which is currently queued 
in my tree and I am planning to push it to Linus soon, as it fixes memory 
corruption) fixes your issue? Thanks.

commit 9c9e54a8df0be48aa359744f412377cc55c3b7d2
Author: Jiri Kosina <jkosina@...e.cz>
Date:   Fri Aug 13 12:19:45 2010 +0200

    HID: hiddev: fix memory corruption due to invalid intfdata
    
    Commit bd25f4dd6972755579d0 ("HID: hiddev: use usb_find_interface,
    get rid of BKL") introduced using of private intfdata in hiddev for
    purpose of storing hiddev pointer.
    
    This is a problem, because intf pointer is already being set to struct
    hid_device pointer by HID core. This obviously lead to memory corruptions
    at device disconnect time, such as
    
    WARNING: at lib/kobject.c:595 kobject_put+0x37/0x4b()
    kobject: '(null)' (ffff88011e9cd898): is not initialized, yet kobject_put() is being called.
    
    Convert hiddev into accessing hiddev through struct hid_device which is
    in intfdata already.
    
    Reported-and-tested-by: Markus Trippelsdorf <markus@...ppelsdorf.de>
    Reported-and-tested-by: Heinz Diehl <htd@...tha.org>
    Reported-and-tested-by: Alan Ott <alan@...nal11.us>
    Signed-off-by: Jiri Kosina <jkosina@...e.cz>

diff --git a/drivers/hid/usbhid/hiddev.c b/drivers/hid/usbhid/hiddev.c
index f285017..0a29c51 100644
--- a/drivers/hid/usbhid/hiddev.c
+++ b/drivers/hid/usbhid/hiddev.c
@@ -266,13 +266,15 @@ static int hiddev_open(struct inode *inode, struct file *file)
 {
 	struct hiddev_list *list;
 	struct usb_interface *intf;
+	struct hid_device *hid;
 	struct hiddev *hiddev;
 	int res;
 
 	intf = usb_find_interface(&hiddev_driver, iminor(inode));
 	if (!intf)
 		return -ENODEV;
-	hiddev = usb_get_intfdata(intf);
+	hid = usb_get_intfdata(intf);
+	hiddev = hid->hiddev;
 
 	if (!(list = kzalloc(sizeof(struct hiddev_list), GFP_KERNEL)))
 		return -ENOMEM;
@@ -890,7 +892,6 @@ int hiddev_connect(struct hid_device *hid, unsigned int force)
 	hid->hiddev = hiddev;
 	hiddev->hid = hid;
 	hiddev->exist = 1;
-	usb_set_intfdata(usbhid->intf, usbhid);
 	retval = usb_register_dev(usbhid->intf, &hiddev_class);
 	if (retval) {
 		err_hid("Not able to get a minor for this device.");

-- 
Jiri Kosina
SUSE Labs, Novell Inc.
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/