linux-kernel - Re: kernel panic in spi_complete() on spitz (PXA270)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 30 Jun 2011 17:36:57 +0200
From:	Pavel Herrmann <morpheus.ibis@...il.com>
To:	Stanislav Brabec <utx@...guin.cz>
Cc:	Marek Vasut <marek.vasut@...il.com>,
	linux-arm-kernel@...ts.infradead.org,
	zaurus-devel@...ts.linuxtogo.org,
	spi-devel-general@...ts.sourceforge.net,
	Igor Grinberg <grinberg@...pulab.co.il>, vapier@...too.org,
	khilman@...prootsystems.com, dmitry.torokhov@...il.com,
	linux-kernel@...r.kernel.org, pavel@....cz,
	linux-input@...r.kernel.org, eric.y.miao@...il.com,
	akpm@...ux-foundation.org, broonie@...nsource.wolfsonmicro.com
Subject: Re: kernel panic in spi_complete() on spitz (PXA270)

On Thursday, June 30, 2011 04:45:18 PM Stanislav Brabec wrote:
> Then I tried to apply "[PATCH] MAX1111: Fix race condition causing NULL
> pointer exception", connected charger that periodically disconnects and
> not seen the crash again. No OOPS was seen after ~100 reconnects.
> 
> So I guess that MAX1111 AC voltage reading (via SPI) was involved in an
> incorrect moment and race happened there and your MAX1111 race condition
> fix fixes it.

Hi,

Are you using the first or second version of the patch? if the former, please 
use v2 (sent a few days later), which has solved the same problem by using a 
mutex instead of allocating message data on stack (which is not good for DMA)

as for the backstory, this crash ocurrs when a short (measured in time spent) 
message was enqueued after a long message, so that the short one finished first 
(the actual bug was present even if the long one finished first, but in that 
case there was double complete() on the one completion instead of a NULL 
dereference)

Pavel
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/