linux-kernel - Re: BUG: usb: obex in g_nokia.ko causing kernel panic

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Tue, 26 Nov 2013 12:59:13 -0600
From:	Felipe Balbi <balbi@...com>
To:	Pali Rohár <pali.rohar@...il.com>
CC:	<balbi@...com>, Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
	<linux-usb@...r.kernel.org>, <linux-kernel@...r.kernel.org>,
	Pavel Machek <pavel@....cz>,
	Aaro Koskinen <aaro.koskinen@....fi>, <freemangordon@....bg>,
	Sebastian Reichel <sre@...g0.de>
Subject: Re: BUG: usb: obex in g_nokia.ko causing kernel panic

Hi,

On Tue, Nov 26, 2013 at 07:10:08PM +0100, Pali Rohár wrote:
> > > > > (above dump is from 3.12-rc5 kernel)
> > > > 
> > > > looks like it's trying to do i2c transfers from atomic.
> > > > But why only when obex is enabled ? Makes no sense. What
> > > > do you have on userland ? Is there anything trying to
> > > > access the obex interface ? Was the USB cable attached at
> > > > that time ?
> > > 
> > > Yes, only when initliaizing obex. Other is ok. Problem is
> > > there with Maemo userland and also with clean userland
> > > (rescueOS) where is only busybox and some simple init
> > > scripts. On Maemo maybe something is trying to access obex,
> > > but on rescueOS for sure nothing. Problem happends when
> > > cable is attached and also when not = always.
> > 
> > As a debug effort, can you apply hack below and see if it
> > "helps" ?
> > 
> > diff --git a/drivers/usb/gadget/f_obex.c
> > b/drivers/usb/gadget/f_obex.c index ad39f1d..4af2f06 100644
> > --- a/drivers/usb/gadget/f_obex.c
> > +++ b/drivers/usb/gadget/f_obex.c
> > @@ -267,10 +267,12 @@ static void obex_connect(struct gserial
> > *g) if (!obex->can_activate)
> >  		return;
> > 
> > +#if 0
> >  	status = usb_function_activate(&g->func);
> >  	if (status)
> >  		DBG(cdev, "obex ttyGS%d function activate --> %d\n",
> >  			obex->port_num, status);
> > +#endif
> >  }
> > 
> >  static void obex_disconnect(struct gserial *g)
> > @@ -282,10 +284,12 @@ static void obex_disconnect(struct
> > gserial *g) if (!obex->can_activate)
> >  		return;
> > 
> > +#if 0
> >  	status = usb_function_deactivate(&g->func);
> >  	if (status)
> >  		DBG(cdev, "obex ttyGS%d function deactivate --> %d\n",
> >  			obex->port_num, status);
> > +#endif
> >  }
> > 
> >  /*-----------------------------------------------------------
> > --------------*/ @@ -372,6 +376,7 @@ static int
> > obex_bind(struct usb_configuration *c, struct usb_function
> > *f) if (status)
> >  		goto fail;
> > 
> > +#if 0
> >  	/* Avoid letting this gadget enumerate until the userspace
> >  	 * OBEX server is active.
> >  	 */
> > @@ -381,6 +386,7 @@ static int obex_bind(struct
> > usb_configuration *c, struct usb_function *f) obex->port_num,
> > status);
> >  	else
> >  		obex->can_activate = true;
> > +#endif
> > 
> > 
> >  	DBG(cdev, "obex ttyGS%d: %s speed IN/%s OUT/%s\n",
> 
> Hi, with above patch g_nokia.ko working and not crashing.

yeah, makes sense. We shouldn't call phy operations in atomic context.
I'll see how easy it would be to fix that. Real patch coming soon(-ish).

-- 
balbi

Download attachment "signature.asc" of type "application/pgp-signature" (837 bytes)