linux-kernel - Re: BUG: usb: obex in g_nokia.ko causing kernel panic

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20131126171606.GO24310@saruman.home>
Date:	Tue, 26 Nov 2013 11:16:06 -0600
From:	Felipe Balbi <balbi@...com>
To:	Pali Rohár <pali.rohar@...il.com>
CC:	Felipe Balbi <balbi@...com>,
	Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
	<linux-usb@...r.kernel.org>, <linux-kernel@...r.kernel.org>,
	Pavel Machek <pavel@....cz>,
	Aaro Koskinen <aaro.koskinen@....fi>, <freemangordon@....bg>,
	Sebastian Reichel <sre@...g0.de>
Subject: Re: BUG: usb: obex in g_nokia.ko causing kernel panic

Hi,

On Tue, Nov 19, 2013 at 11:51:12AM +0100, Pali Rohár wrote:
> Hi!
> 
> For a long time (since 3.5 or 3.8? - I do not remember) obex
> subdriver in g_nokia usb gadget module causing kernel panic after
> module is loaded on Nokia N900. I do not know where is problem
> and due to immediatelly kernel crash when loading driver I was
> not able to see any dmesg output. Now I was able to store
> something into mtd log and here is crash backtrace:
> 
> Log Entry 437 (at position 52)
> <4>[   18.606414] [<c037eac0>] (__schedule+0x5c/0x50c) from [<c037d3bc>] (schedule_timeout+0x1f4/0x25c)
> <4>[   18.623809] [<c037d3bc>] (schedule_timeout+0x1f4/0x25c) from [<c037f12c>] (wait_for_common+0xc8/0x1ac)
> <4>[   18.649291] [<c037f12c>] (wait_for_common+0xc8/0x1ac) from [<c028c1c0>] (omap_i2c_xfer+0x338/0x488)
> <4>[   18.674499] [<c028c1c0>] (omap_i2c_xfer+0x338/0x488) from [<c0288144>] (__i2c_transfer+0x40/0x74)
> <4>[   18.692047] [<c0288144>] (__i2c_transfer+0x40/0x74) from [<c0288a2c>] (i2c_transfer+0x6c/0x90)
> <4>[   18.709320] [<c0288a2c>] (i2c_transfer+0x6c/0x90) from [<c02351c8>] (regmap_i2c_read+0x48/0x68)
> <4>[   18.726715] [<c02351c8>] (regmap_i2c_read+0x48/0x68) from [<c023161c>] (_regmap_raw_read+0x128/0x220)
> <4>[   18.752685] [<c023161c>] (_regmap_raw_read+0x128/0x220) from [<c02317b4>] (regmap_raw_read+0xa0/0x130)
> <4>[   18.779052] [<c02317b4>] (regmap_raw_read+0xa0/0x130) from [<c023193c>] (regmap_bulk_read+0xf8/0x16c)
> <4>[   18.805694] [<c023193c>] (regmap_bulk_read+0xf8/0x16c) from [<c0238ea8>] (twl_i2c_read+0xa4/0xe0)
> <4>[   18.823730] [<c0238ea8>] (twl_i2c_read+0xa4/0xe0) from [<c0274d34>] (__twl4030_phy_power.isra.12+0x1c/0x58)
> <4>[   18.850921] [<c0274d34>] (__twl4030_phy_power.isra.12+0x1c/0x58) from [<c0274df0>] 
> (twl4030_phy_power.part.14+0x80/0xc8)
> <4>[   18.879699] [<c0274df0>] (twl4030_phy_power.part.14+0x80/0xc8) from [<c0274f9c>] 
> (twl4030_set_suspend+0x54/0x1e8)
> <4>[   18.908325] [<c0274f9c>] (twl4030_set_suspend+0x54/0x1e8) from [<c027c8c4>] 
> (omap2430_runtime_resume+0x5c/0x64)
> <4>[   18.937042] [<c027c8c4>] (omap2430_runtime_resume+0x5c/0x64) from [<c0225dd0>] 
> (pm_generic_runtime_resume+0x2c/0x38)
> <4>[   18.966461] [<c0225dd0>] (pm_generic_runtime_resume+0x2c/0x38) from [<c0229fe0>] (__rpm_callback+0x54/0x80)
> <4>[   18.995117] [<c0229fe0>] (__rpm_callback+0x54/0x80) from [<c022a04c>] (rpm_callback+0x40/0x74)
> <4>[   19.013610] [<c022a04c>] (rpm_callback+0x40/0x74) from [<c022b3c8>] (rpm_resume+0x448/0x63c)
> <4>[   19.031921] [<c022b3c8>] (rpm_resume+0x448/0x63c) from [<c022b2e4>] (rpm_resume+0x364/0x63c)
> <4>[   19.050140] [<c022b2e4>] (rpm_resume+0x364/0x63c) from [<c022b874>] (__pm_runtime_resume+0x48/0x74)
> <4>[   19.077728] [<c022b874>] (__pm_runtime_resume+0x48/0x74) from [<c027b4fc>] (musb_gadget_pullup+0x1c/0xb4)
> <4>[   19.105895] [<c027b4fc>] (musb_gadget_pullup+0x1c/0xb4) from [<bf025c14>] (usb_function_deactivate+0x54/0xa4 
> [libcomposite])
> <4>[   19.135955] [<bf025c14>] (usb_function_deactivate+0x54/0xa4 [libcomposite]) from [<bf05b3b8>] 
> (obex_bind+0x124/0x1d8 [usb_f_obex])
> <4>[   19.166870] [<bf05b3b8>] (obex_bind+0x124/0x1d8 [usb_f_obex]) from [<bf025794>] (usb_add_function+0x58/0xf4 
> [libcomposite])
> <4>[   19.197143] [<bf025794>] (usb_add_function+0x58/0xf4 [libcomposite]) from [<bf037420>] 
> (nokia_bind_config+0x204/0x250 [g_nokia])
> <4>[   19.227905] [<bf037420>] (nokia_bind_config+0x204/0x250 [g_nokia]) from [<bf0263fc>] (usb_add_config+0x28/0xc0 
> [libcomposite])
> <4>[   19.258483] [<bf0263fc>] (usb_add_config+0x28/0xc0 [libcomposite]) from [<bf03709c>] (nokia_bind+0x9c/0x21c 
> [g_nokia])
> <4>[   19.288421] [<bf03709c>] (nokia_bind+0x9c/0x21c [g_nokia]) from [<bf0275bc>] (composite_bind+0x74/0x180 
> [libcomposite])
> <4>[   19.318420] [<bf0275bc>] (composite_bind+0x74/0x180 [libcomposite]) from [<c027d658>] 
> (udc_bind_to_driver+0x2c/0xc4)
> <4>[   19.348114] [<c027d658>] (udc_bind_to_driver+0x2c/0xc4) from [<c027d764>] (usb_gadget_probe_driver+0x74/0x94)
> <4>[   19.377166] [<c027d764>] (usb_gadget_probe_driver+0x74/0x94) from [<c00086f8>] (do_one_initcall+0x94/0x138)
> <4>[   19.406005] [<c00086f8>] (do_one_initcall+0x94/0x138) from [<c007a460>] (load_module+0x113c/0x13c4)
> <4>[   19.434051] [<c007a460>] (load_module+0x113c/0x13c4) from [<c007a7b4>] (SyS_init_module+0xcc/0xec)
> <4>[   19.462127] [<c007a7b4>] (SyS_init_module+0xcc/0xec) from [<c000dd40>] (ret_fast_syscall+0x0/0x30)
> <0>[   19.490753] Code: 0a00002e e1a00004 eb001438 e598300c (e5d3202c) 
> <4>[   19.506805] ---[ end trace 060b62ec0d68a78b ]---
> <0>[   19.523132] Kernel panic - not syncing: Fatal exception in interrupt
> 
> (above dump is from 3.12-rc5 kernel)

looks like it's trying to do i2c transfers from atomic. But why only
when obex is enabled ? Makes no sense. What do you have on userland ? Is
there anything trying to access the obex interface ? Was the USB cable
attached at that time ?

-- 
balbi

Download attachment "signature.asc" of type "application/pgp-signature" (837 bytes)