linux-kernel - Re: [PATCH] xhci-ring: Fix Null pointer dereference

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date:	Mon, 1 Sep 2014 11:36:13 +0200
From:	Ricardo Ribalda Delgado <ricardo.ribalda@...il.com>
To:	Mathias Nyman <mathias.nyman@...el.com>
Cc:	Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
	Linux USB Mailing List <linux-usb@...r.kernel.org>,
	LKML <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH] xhci-ring: Fix Null pointer dereference

After some time of use (one hour or so) my system started to behave
"weird". I did check  dmesg and I was receiving the following line
again and again:

usb-storage: Error in queuecommand_lck: us->sfb= ffff8805bd61ccc0

I did disconnect the usb device and the whole computer crashed :S



On Mon, Sep 1, 2014 at 11:02 AM, Ricardo Ribalda Delgado
<ricardo.ribalda@...il.com> wrote:
> Hello
>
> The promised dmesg output. Still some "xhci_drop_endpoint called with..."
>
> Thanks!
>
> Sep  1 10:52:00 neopili kernel: [  193.123108] usb 2-2: new SuperSpeed
> USB device number 2 using xhci_hcd
> Sep  1 10:52:00 neopili kernel: [  193.142204] usb 2-2: New USB device
> found, idVendor=0525, idProduct=a4a5
> Sep  1 10:52:00 neopili kernel: [  193.142211] usb 2-2: New USB device
> strings: Mfr=3, Product=4, SerialNumber=0
> Sep  1 10:52:00 neopili kernel: [  193.142215] usb 2-2: Product: Mass
> Storage Gadget
> Sep  1 10:52:00 neopili kernel: [  193.142218] usb 2-2: Manufacturer:
> Linux 3.16.0-qtec-standard+ with net2280
> Sep  1 10:52:00 neopili systemd-udevd[221]: unknown key
> 'SYSFS{manufacturer}' in /etc/udev/rules.d/52-digilent-usb.rules:35
> Sep  1 10:52:00 neopili systemd-udevd[221]: invalid rule
> '/etc/udev/rules.d/52-digilent-usb.rules:35'
> Sep  1 10:52:00 neopili systemd-udevd[221]: unknown key 'BUS' in
> /lib/udev/rules.d/60-libgnuradio-fcd3.7.3.rules:2
> Sep  1 10:52:00 neopili systemd-udevd[221]: invalid rule
> '/lib/udev/rules.d/60-libgnuradio-fcd3.7.3.rules:2'
> Sep  1 10:52:00 neopili systemd-udevd[1720]: failed to execute
> '/lib/udev/mtp-probe' 'mtp-probe
> /sys/devices/pci0000:00/0000:00:1c.6/0000:0e:00.0/usb2/2-2 2 2': No
> such file or directory
> Sep  1 10:52:00 neopili kernel: [  193.289553] usb-storage 2-2:1.0:
> USB Mass Storage device detected
> Sep  1 10:52:00 neopili kernel: [  193.289745] usb-storage 2-2:1.0:
> Quirks match for vid 0525 pid a4a5: 10000
> Sep  1 10:52:00 neopili kernel: [  193.289820] scsi host6: usb-storage 2-2:1.0
> Sep  1 10:52:00 neopili kernel: [  193.289991] usbcore: registered new
> interface driver usb-storage
> Sep  1 10:52:00 neopili kernel: [  193.312632] usbcore: registered new
> interface driver uas
> Sep  1 10:52:01 neopili kernel: [  194.288067] scsi 6:0:0:0:
> Direct-Access     Linux    File-Stor Gadget 0316 PQ: 0 ANSI: 2
> Sep  1 10:52:01 neopili kernel: [  194.288957] sd 6:0:0:0: Attached
> scsi generic sg2 type 0
> Sep  1 10:52:01 neopili kernel: [  194.290003] sd 6:0:0:0: [sdb] 32768
> 512-byte logical blocks: (16.7 MB/16.0 MiB)
> Sep  1 10:52:01 neopili kernel: [  194.403012] usb 2-2: reset
> SuperSpeed USB device number 2 using xhci_hcd
> Sep  1 10:52:01 neopili kernel: [  194.419901] xhci_hcd 0000:0e:00.0:
> xHCI xhci_drop_endpoint called with disabled ep ffff8805e68915c8
> Sep  1 10:52:01 neopili kernel: [  194.419907] xhci_hcd 0000:0e:00.0:
> xHCI xhci_drop_endpoint called with disabled ep ffff8805e6891580
> Sep  1 10:52:31 neopili kernel: [  224.908382] usb 2-2: reset
> SuperSpeed USB device number 2 using xhci_hcd
> Sep  1 10:52:31 neopili kernel: [  224.925090] xhci_hcd 0000:0e:00.0:
> xHCI xhci_drop_endpoint called with disabled ep ffff8805e68915c8
> Sep  1 10:52:31 neopili kernel: [  224.925100] xhci_hcd 0000:0e:00.0:
> xHCI xhci_drop_endpoint called with disabled ep ffff8805e6891580
> Sep  1 10:52:31 neopili kernel: [  224.926327] sd 6:0:0:0: [sdb] Write
> Protect is off
> Sep  1 10:52:31 neopili kernel: [  224.926336] sd 6:0:0:0: [sdb] Mode
> Sense: 00 00 00 00
>
> On Fri, Aug 29, 2014 at 5:20 PM, Mathias Nyman <mathias.nyman@...el.com> wrote:
>> On 08/28/2014 06:09 PM, Ricardo Ribalda Delgado wrote:
>>> Sure, but the hw leaves my desk until next monday in 30 minutes.
>>>
>>> So unless you send the patch right now you will have to wait for
>>> results until next Monday
>>>
>>> Thanks!
>>>
>>
>> Great, anytime you can test it is appreciated.
>> Added the patch to the bug:
>> https://bugzilla.kernel.org/show_bug.cgi?id=75521
>>
>> Patch looks like this:
>>
>> diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
>> index c020b09..7aee5a3 100644
>> --- a/drivers/usb/host/xhci.c
>> +++ b/drivers/usb/host/xhci.c
>> @@ -3544,6 +3544,10 @@ int xhci_discover_or_reset_device(struct usb_hcd *hcd, struct usb_device *udev)
>>         for (i = 1; i < 31; ++i) {
>>                 struct xhci_virt_ep *ep = &virt_dev->eps[i];
>>
>> +               /* reset device sets ep states to disabled, also halted ones */
>> +               ep->ep_state &= ~(EP_HALTED || SET_DEQ_PENDING);
>> +               ep->stopped_td = NULL;
>> +
>>                 if (ep->ep_state & EP_HAS_STREAMS) {
>>                         xhci_warn(xhci, "WARN: endpoint 0x%02x has streams on device reset, freeing streams.\n",
>>                                         xhci_get_endpoint_address(i));
>>
>>
>> -Mathias
>>
>
>
>
> --
> Ricardo Ribalda



-- 
Ricardo Ribalda
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/