linux-kernel - Re: xHCI corruption after double URB submit

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <Pine.LNX.4.44L0.1507291013280.1814-100000@iolanthe.rowland.org>
Date:	Wed, 29 Jul 2015 10:15:11 -0400 (EDT)
From:	Alan Stern <stern@...land.harvard.edu>
To:	Laura Abbott <labbott@...hat.com>
cc:	Mathias Nyman <mathias.nyman@...el.com>,
	Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
	<linux-usb@...r.kernel.org>,
	Linux Kernel Mailing List <linux-kernel@...r.kernel.org>
Subject: Re: xHCI corruption after double URB submit

On Tue, 28 Jul 2015, Laura Abbott wrote:

> Hi,
> 
> While debugging an issue with another driver, I've hit some corruption in xHCI.
> I'm not sure if the corruption is directly caused by the first warning or if
> the warning is exposing an issue with the driver. The issue I was actually
> trying to debug was a URB double submit:
> 
> ------------[ cut here ]------------
> WARNING: CPU: 3 PID: 3563 at drivers/usb/core/urb.c:339 usb_submit_urb+0x2ad/0x5a0()
> URB ffff8804078ac240 submitted while active

...

> I've found several issues where a double submit can happen so I mostly have
> a handle on that. Shortly after the double submit though, I see corruption:
> 
>   ------------[ cut here ]------------
>   WARNING: CPU: 3 PID: 0 at lib/list_debug.c:36 __list_add+0xb4/0xc0()
>   list_add double add: new=ffff8804078ac260, prev=ffff8804078ac260, next=ffff88040456c358.

> which will repeat itself until the kernel GPFs or crashes somewhere
> else. The test case for reproducing this is sending commands to the
> USB driver very rapidly so the double submit is happening fairly
> frequently. Is this a case where the driver is very questionable so
> all bets are off or is this an issue in the xHCI layer? I've never
> seen any other double submit reports indicating this type of corruption.

It's fair to say that once a double-submit error occurs, all bets are 
off.

Alan Stern

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/