linux-kernel - [Walkera WK-0701 joystick] BUG: unable to handle kernel NULL pointer dereference at (null)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:	Tue, 11 Dec 2012 15:53:53 +0800
From:	Fengguang Wu <fengguang.wu@...el.com>
To:	Peter Popovec <popovec@....fei.tuke.sk>
Cc:	Dmitry Torokhov <dtor@...l.ru>, LKML <linux-kernel@...r.kernel.org>
Subject: [Walkera WK-0701 joystick] BUG: unable to handle kernel NULL pointer
 dereference at (null)

Greetings,

This oops happens in upstream kernel as well as very old kernels.
Looks like related to the Walkera WK-0701 driver.

[   37.271520] evbug: Connected device: input1 (AT Translated Set 2 keyboard at isa0060/serio0/input0)
[   37.288450] input: Walkera WK-0701 TX as /devices/virtual/input/input2
[   37.294872] BUG: unable to handle kernel NULL pointer dereference at           (null)
[   37.296265] IP: [<ffffffff81076607>] hrtimer_try_to_cancel+0x17/0xd8
[   37.297847] PGD 0 
[   37.298423] Oops: 0000 [#1] 
[   37.299164] CPU 0 
[   37.299879] Pid: 1, comm: swapper Not tainted 3.7.0-rc8-00041-gcaf4919 #1 Bochs Bochs
[   37.300290] RIP: 0010:[<ffffffff81076607>]  [<ffffffff81076607>] hrtimer_try_to_cancel+0x17/0xd8
[   37.300290] RSP: 0000:ffffffff819e9d78  EFLAGS: 00000092
[   37.300290] RAX: 00000008aee4b343 RBX: ffffffff825c1da0 RCX: 0000000000000018
[   37.300290] RDX: 000000000000047b RSI: 0000000000000000 RDI: ffffffff825c1da0
[   37.300290] RBP: ffffffff819e9d98 R08: 0000000000000000 R09: 0000000000000000
[   37.300290] R10: 0000000000000001 R11: 0000000000000000 R12: 00000008aee4b343
[   37.300290] R13: ffff88000d1e9960 R14: 0000000000000000 R15: 0000000000000000
[   37.300290] FS:  0000000000000000(0000) GS:ffffffff819e6000(0000) knlGS:0000000000000000
[   37.300290] CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
[   37.300290] CR2: 0000000000000000 CR3: 00000000019d4000 CR4: 00000000000006f0
[   37.300290] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[   37.300290] DR3: 0000000000000000 DR6: 0000000000000000 DR7: 0000000000000000
[   37.300290] Process swapper (pid: 1, threadinfo ffff88000d078000, task ffff88000d070000)
[   37.300290] Stack:
[   37.300290]  ffffffff825c1d60 00000008aee4b343 ffff88000d1e9960 ffffffff825c1da0
[   37.300290]  ffffffff819e9df8 ffffffff8150de5b ffff88000fb8a6a0 ffff88000d1e9960
[   37.300290]  0000000000000000 ffff880006419000 ffffffff819e9df8 ffff88000fb8a400
[   37.300290] Call Trace:
[   37.300290]  <IRQ> 
[   37.300290]  [<ffffffff8150de5b>] walkera0701_irq_handler+0x39/0x3de
[   37.300290]  [<ffffffff813eee02>] parport_irq_handler+0x3e/0x5c
[   37.300290]  [<ffffffff810adf59>] handle_irq_event_percpu+0x7a/0x29a
[   37.300290]  [<ffffffff810ae1ba>] handle_irq_event+0x41/0x67
[   37.300290]  [<ffffffff810b081f>] ? handle_level_irq+0x24/0xfb
[   37.300290]  [<ffffffff810b08ec>] handle_level_irq+0xf1/0xfb
[   37.300290]  [<ffffffff8100383f>] handle_irq+0x16f/0x1a1
[   37.300290]  [<ffffffff810b5f6d>] ? rcu_irq_enter+0xb1/0x10b
[   37.300290]  [<ffffffff810035fa>] do_IRQ+0x4a/0xaa
[   37.300290]  [<ffffffff816930f0>] common_interrupt+0x70/0x70
[   37.300290]  <EOI> 
[   37.300290]  [<ffffffff810cc507>] ? trace_hardirqs_on+0x60/0x107
[   37.300290]  [<ffffffff814fa370>] ? input_open_device+0x67/0xab
[   37.300290]  [<ffffffff814fa370>] ? input_open_device+0x67/0xab
[   37.300290]  [<ffffffff8150058c>] evbug_connect+0x6c/0xe0
[   37.300290]  [<ffffffff814f93f7>] input_attach_handler+0x1b5/0x1ed
[   37.300290]  [<ffffffff81d3a27b>] ? zhenhua_drv_init+0x1b/0x1b
[   37.300290]  [<ffffffff814fab7e>] input_register_device+0x38d/0x3c4
[   37.300290]  [<ffffffff81d3a49d>] walkera0701_init+0x222/0x299
[   37.300290]  [<ffffffff81d3a260>] ? warrior_drv_init+0x1b/0x1b
[   37.300290]  [<ffffffff81d0ad11>] do_one_initcall+0x78/0x136
[   37.300290]  [<ffffffff81660872>] kernel_init+0x120/0x2ae
[   37.300290]  [<ffffffff81d0a53c>] ? loglevel+0x31/0x31
[   37.300290]  [<ffffffff81660752>] ? rest_init+0xd2/0xd2
[   37.300290]  [<ffffffff81693b7a>] ret_from_fork+0x7a/0xb0
[   37.300290]  [<ffffffff81660752>] ? rest_init+0xd2/0xd2
[   37.300290] Code: 48 89 e5 41 b8 01 00 00 00 89 d1 31 d2 e8 fd fc ff ff 5d c3 66 66 66 66 90 55 48 89 e5 41 56 41 55 41 54 53 48 89 fb 4c 8b 77 30 <49> 8b 3e e8 4e bc 61 00 49 89 c5 48 8b 43 38 a8 02 75 67 a8 01 
[   37.300290] RIP  [<ffffffff81076607>] hrtimer_try_to_cancel+0x17/0xd8
[   37.300290]  RSP <ffffffff819e9d78>
[   37.300290] CR2: 0000000000000000

Thanks,
Fengguang

View attachment "dmesg-kvm-ant-8259-2012-12-11-04-08-53-3.7.0-rc8-00041-gcaf4919-1" of type "text/plain" (28358 bytes)

View attachment "config-3.7.0-rc8-00041-gcaf4919" of type "text/plain" (58261 bytes)