| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Mon, 20 Sep 2010 10:11:18 -0400
From: Phil Turmel <philip@...mel.org>
To: Jiri Kosina <jkosina@...e.cz>
CC: Guillaume Chazarain <guichaz@...il.com>,
linux-kernel@...r.kernel.org, Greg Kroah-Hartman <gregkh@...e.de>,
Alan Stern <stern@...land.harvard.edu>,
Oliver Neukum <oliver@...kum.org>, Alan Ott <alan@...nal11.us>,
linux-usb@...r.kernel.org, linux-input@...r.kernel.org,
Mat <jackdachef@...il.com>, Andreas Bombe <aeb@...ian.org>,
Alex Riesen <raa.lkml@...il.com>
Subject: Re: [BUG, Regression, bisected] USB mouse causes bug on 1st insert,
ignored on 2nd insert, lsusb stuck at usbdev_open
On 09/20/2010 09:25 AM, Jiri Kosina wrote:
> The patch below should at least tell us the same what addr2line would tell
> us. The dmesg lines preceeding the OOPS will be interesting. Thanks.
>
>
>
> diff --git a/drivers/hid/usbhid/hiddev.c b/drivers/hid/usbhid/hiddev.c
> index 681e620..3a5f097 100644
> --- a/drivers/hid/usbhid/hiddev.c
> +++ b/drivers/hid/usbhid/hiddev.c
> @@ -270,17 +270,26 @@ static int hiddev_open(struct inode *inode, struct file *file)
> struct hiddev *hiddev;
> int res;
>
> + printk("A\n");
> intf = usbhid_find_interface(iminor(inode));
> + printk("B\n");
> if (!intf)
> return -ENODEV;
> + printk("C\n");
> hid = usb_get_intfdata(intf);
> + printk("D\n");
> hiddev = hid->hiddev;
> + printk("E\n");
>
> if (!(list = kzalloc(sizeof(struct hiddev_list), GFP_KERNEL)))
> return -ENOMEM;
> + printk("F\n");
> mutex_init(&list->thread_lock);
> + printk("G\n");
> list->hiddev = hiddev;
> + printk("H\n");
> file->private_data = list;
> + printk("I\n");
>
> /*
> * no need for locking because the USB major number
> @@ -298,11 +307,14 @@ static int hiddev_open(struct inode *inode, struct file *file)
> res = -ENODEV;
> goto bail;
> }
> + printk("J\n");
>
> spin_lock_irq(&list->hiddev->list_lock);
> list_add_tail(&list->node, &hiddev->list);
> spin_unlock_irq(&list->hiddev->list_lock);
>
> + printk("K\n");
> +
> if (!list->hiddev->open++)
> if (list->hiddev->exist) {
> struct hid_device *hid = hiddev->hid;
> @@ -313,10 +325,13 @@ static int hiddev_open(struct inode *inode, struct file *file)
> }
> usbhid_open(hid);
> }
> + printk("L\n");
> return 0;
> bail:
> + printk("M\n");
> file->private_data = NULL;
> kfree(list);
> + printk("N\n");
> return res;
> }
here you go:
[ 16.689736] Adding 4192960k swap on /dev/sda3. Priority:-1 extents:1 across:4192960k
[ 28.307298] A
[ 28.307308] B
[ 28.307309] C
[ 28.307311] D
[ 28.307312] E
[ 28.307334] F
[ 28.307335] G
[ 28.307336] H
[ 28.307337] I
[ 28.307345] BUG: unable to handle kernel NULL pointer dereference at (null)
[ 28.307881] IP: [<ffffffff817d0a22>] hiddev_open+0x152/0x2e0
[ 28.308949] PGD 1398fa067 PUD 1398fb067 PMD 0
[ 28.310004] Oops: 0000 [#1] PREEMPT SMP
[ 28.310004] last sysfs file: /sys/devices/platform/toshiba_acpi/backlight/toshiba/max_brightness
[ 28.310004] CPU 0
[ 28.310004] Modules linked in: tpm_infineon iwlagn iwlcore tpm_tis tifm_7xx1 toshiba_acpi toshiba_bluetooth tifm_core pcmcia sdhci_pci sdhci yenta_socket [last unloaded: scsi_wait_scan]
[ 28.313737]
[ 28.313737] Pid: 3152, comm: hald-probe-hidd Not tainted 2.6.36-rc4-00167-g48e80ac #17 Portable PC/TECRA A9
[ 28.313737] RIP: 0010:[<ffffffff817d0a22>] [<ffffffff817d0a22>] hiddev_open+0x152/0x2e0
[ 28.313737] RSP: 0018:ffff88013786bc38 EFLAGS: 00010296
[ 28.313737] RAX: 0000000000000000 RBX: ffff88013a016d80 RCX: ffffffff820c7de0
[ 28.313737] RDX: ffffffff81e72a48 RSI: 0000000000000046 RDI: ffffffff820c7cd0
[ 28.313737] RBP: ffff88013786bc58 R08: 00000000ffffffff R09: 0000000000000000
[ 28.313737] R10: 0000000000000000 R11: 0000000000000002 R12: ffff880139e80000
[ 28.313737] R13: 0000000000000000 R14: 00000000ffffffed R15: ffff880138fa5af8
[ 28.313737] FS: 00007f2a9595c700(0000) GS:ffff880002400000(0000) knlGS:0000000000000000
[ 28.313737] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 28.313737] CR2: 0000000000000000 CR3: 0000000139f1a000 CR4: 00000000000006f0
[ 28.313737] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 28.313737] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
[ 28.313737] Process hald-probe-hidd (pid: 3152, threadinfo ffff88013786a000, task ffff88013b1b2ed0)
[ 28.313737] Stack:
[ 28.313737] ffff88013a016d80 ffffffff81b57c20 ffffffff81b66420 00000000ffffffed
[ 28.313737] <0> ffff88013786bc98 ffffffff8171794b 000000000029d5f6 ffff88013bb46d80
[ 28.313737] <0> ffff880138fa5af8 ffff88013a016d80 0000000000000000 ffffffff81156ae0
[ 28.313737] Call Trace:
[ 28.313737] [<ffffffff8171794b>] usb_open+0x10b/0x2b0
[ 28.313737] [<ffffffff81156ae0>] ? chrdev_open+0x0/0x280
[ 28.313737] [<ffffffff81156c07>] chrdev_open+0x127/0x280
[ 28.313737] [<ffffffff81156ae0>] ? chrdev_open+0x0/0x280
[ 28.313737] [<ffffffff81151508>] __dentry_open+0x108/0x3a0
[ 28.313737] [<ffffffff811518b4>] nameidata_to_filp+0x54/0x70
[ 28.313737] [<ffffffff8115f668>] do_last+0x3b8/0x6c0
[ 28.313737] [<ffffffff811618a8>] do_filp_open+0x228/0x670
[ 28.313737] [<ffffffff81919b65>] ? T.827+0x135/0x230
[ 28.313737] [<ffffffff8116c4aa>] ? alloc_fd+0xfa/0x140
[ 28.313737] [<ffffffff811512c5>] do_sys_open+0x65/0x130
[ 28.313737] [<ffffffff811513d0>] sys_open+0x20/0x30
[ 28.313737] [<ffffffff81037c1b>] system_call_fastpath+0x16/0x1b
[ 28.313737] Code: c0 4d 89 ac 24 18 c0 00 00 e8 e2 d5 2b 00 31 c0 4c 89 a3 98 00 00 00 48 c7 c7 11 43 c9 81 e8 cd d5 2b 00 49 8b 84 24 18 c0 00 00 <83> 38 00 0f 84 d9 00 00 00 8b 50 04 8d 4a 01 85 d2 89 48 04 75
[ 28.313737] RIP [<ffffffff817d0a22>] hiddev_open+0x152/0x2e0
[ 28.313737] RSP <ffff88013786bc38>
[ 28.313737] CR2: 0000000000000000
[ 28.354413] ---[ end trace aac45f6a6d58c1a5 ]---
# addr2line -f -e vmlinux ffffffff817d0a22
hiddev_open
hiddev.c:0
Complete dmesg attached.
Since addr2line couldn't narrow this down, I'm attaching the object dump/disassembly as well.
Let me know what's next.
Regards,
Phil
View attachment "dmesg" of type "text/plain" (74441 bytes)
View attachment "hiddev.od" of type "text/plain" (395785 bytes)
Powered by blists - more mailing lists