linux-kernel - Re: BUG: usb: obex in g_nokia.ko causing kernel panic

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Tue, 26 Nov 2013 11:39:54 -0600
From:	Felipe Balbi <balbi@...com>
To:	Pali Rohár <pali.rohar@...il.com>
CC:	<balbi@...com>, Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
	<linux-usb@...r.kernel.org>, <linux-kernel@...r.kernel.org>,
	Pavel Machek <pavel@....cz>,
	Aaro Koskinen <aaro.koskinen@....fi>, <freemangordon@....bg>,
	Sebastian Reichel <sre@...g0.de>
Subject: Re: BUG: usb: obex in g_nokia.ko causing kernel panic

Hi,

On Tue, Nov 26, 2013 at 06:28:05PM +0100, Pali Rohár wrote:

[ snip ]

> > > (above dump is from 3.12-rc5 kernel)
> > 
> > looks like it's trying to do i2c transfers from atomic. But
> > why only when obex is enabled ? Makes no sense. What do you
> > have on userland ? Is there anything trying to access the
> > obex interface ? Was the USB cable attached at that time ?
> 
> Yes, only when initliaizing obex. Other is ok. Problem is there 
> with Maemo userland and also with clean userland (rescueOS) where 
> is only busybox and some simple init scripts. On Maemo maybe 
> something is trying to access obex, but on rescueOS for sure 
> nothing. Problem happends when cable is attached and also when 
> not = always.

As a debug effort, can you apply hack below and see if it "helps" ?

diff --git a/drivers/usb/gadget/f_obex.c b/drivers/usb/gadget/f_obex.c
index ad39f1d..4af2f06 100644
--- a/drivers/usb/gadget/f_obex.c
+++ b/drivers/usb/gadget/f_obex.c
@@ -267,10 +267,12 @@ static void obex_connect(struct gserial *g)
 	if (!obex->can_activate)
 		return;
 
+#if 0
 	status = usb_function_activate(&g->func);
 	if (status)
 		DBG(cdev, "obex ttyGS%d function activate --> %d\n",
 			obex->port_num, status);
+#endif
 }
 
 static void obex_disconnect(struct gserial *g)
@@ -282,10 +284,12 @@ static void obex_disconnect(struct gserial *g)
 	if (!obex->can_activate)
 		return;
 
+#if 0
 	status = usb_function_deactivate(&g->func);
 	if (status)
 		DBG(cdev, "obex ttyGS%d function deactivate --> %d\n",
 			obex->port_num, status);
+#endif
 }
 
 /*-------------------------------------------------------------------------*/
@@ -372,6 +376,7 @@ static int obex_bind(struct usb_configuration *c, struct usb_function *f)
 	if (status)
 		goto fail;
 
+#if 0
 	/* Avoid letting this gadget enumerate until the userspace
 	 * OBEX server is active.
 	 */
@@ -381,6 +386,7 @@ static int obex_bind(struct usb_configuration *c, struct usb_function *f)
 			obex->port_num, status);
 	else
 		obex->can_activate = true;
+#endif
 
 
 	DBG(cdev, "obex ttyGS%d: %s speed IN/%s OUT/%s\n",

-- 
balbi

Download attachment "signature.asc" of type "application/pgp-signature" (837 bytes)