linux-kernel - OHCI unplug kernel crash in kernel 4.3, 4.4 and 4.5

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <1456651472.1369.3.camel@seibold.net>
Date:	Sun, 28 Feb 2016 10:24:32 +0100
From:	Stefani Seibold <stefani@...bold.net>
To:	linux-usb <linux-usb@...r.kernel.org>,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
	Greg KH <greg@...ah.com>,
	Alan Stern <stern@...land.harvard.edu>,
	Joerg Roedel <jroedel@...e.de>,
	Oliver Neukum <oneukum@...e.com>
Subject: OHCI unplug kernel crash in kernel 4.3, 4.4 and 4.5

I still reported this bug 6 Weeks ago... and i checked it know with the
current kernel 4.5.0-rc5. The bug is yet not fixed.

A unplug of an USB 1.0 OHCI controller express card will result in a
kernel crash. The express card is attached via thunderbolt and a sonnet
express card to thunderbolt adapter. The computer hangs after the
unplug, only a power down fix the situation.

This is the kernel log of a kernel 4.4 via netconsole:

pciehp 0000:06:03.0:pcie24: Card not present on Slot(3)
pciehp 0000:06:03.0:pcie24: slot(3): Link Down event
pciehp 0000:06:03.0:pcie24: Link Down event ignored on slot(3): already
powering off
ehci-pci 0000:0b:00.2: HC died; cleaning up
ehci-pci 0000:0b:00.2: remove, state 4
usb usb5: USB disconnect, device number 1
pciehp 0000:00:1c.4:pcie04: Card not present on Slot(4)
pciehp 0000:00:1c.4:pcie04: slot(4): Link Down event
ehci-pci 0000:0b:00.2: USB bus 5 deregistered
ohci-pci 0000:0b:00.1: HC died; cleaning up
ohci-pci 0000:0b:00.1: remove, state 4
usb usb7: USB disconnect, device number 1
pciehp 0000:00:1c.4:pcie04: Link Down event ignored on slot(4): already
powering off
ohci-pci 0000:0b:00.1: USB bus 7 deregistered
ohci-pci 0000:0b:00.0: HC died; cleaning up
ohci-pci 0000:0b:00.0: remove, state 4
usb usb6: USB disconnect, device number 1
------------[ cut here ]------------
kernel BUG at drivers/iommu/intel-iommu.c:3592!
invalid opcode: 0000 [#1] PREEMPT SMP 
Modules linked in: ohci_pci ohci_hcd binfmt_misc netconsole configfs
bbswitch(O) iwlmvm iwlwifi vboxnetadp(O) vboxnetflt(O) vboxdrv(O)
nvidia(PO) vhost_net tun vhost kvm_intel kvm irqbypass dell_smm_hwmon
[last unloaded: netconsole]
CPU: 0 PID: 4857 Comm: kworker/0:3 Tainted: P           O    4.4.0-
gentoo #1
Hardware name: Dell Inc. XPS 2720/05R2TK  , BIOS A12 09/21/2015
Workqueue: pciehp-3 pciehp_power_thread
task: ffff8804070a2300 ti: ffff8803e4658000 task.ti: ffff8803e4658000
RIP: 0010:[<ffffffff8061edf4>]  [<ffffffff8061edf4>]
intel_unmap+0x1c4/0x1d0
RSP: 0018:ffff8803e465bb98  EFLAGS: 00010246
RAX: 0000000000000000 RBX: ffff8804225fb098 RCX: 00000000ffffc000
RDX: 0000000000000000 RSI: 00000000ffffc000 RDI: ffff8804225fb098
RBP: ffff8803e465bbd0 R08: 0000000000000000 R09: 0000000000000000
R10: ffff88046cc000c0 R11: 0000000000000000 R12: 00000000ffffffff
R13: 00000000ffffc000 R14: ffff880468caa400 R15: ffffe8ffffc13800
FS:  0000000000000000(0000) GS:ffff88047f200000(0000)
knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f2515680324 CR3: 000000000120a000 CR4: 00000000001406f0
Stack:
 ffff8804101e4a78 ffff8803e465bbf0 ffffea000f915840 00000000ffffffff
 ffffffff812a3ec0 ffff880468caa400 ffffe8ffffc13800 ffff8803e465bbf0
 ffffffff8061ee8a ffff88045e68f000 ffff8804225fb098 ffff8803e465bc28
Call Trace:
 [<ffffffff8061ee8a>] intel_free_coherent+0x5a/0xa0
 [<ffffffffa0ad4d04>] ohci_stop+0x144/0x1c0 [ohci_hcd]
 [<ffffffff807e1fb4>] usb_remove_hcd+0xe4/0x1a0
 [<ffffffff807f2203>] usb_hcd_pci_remove+0x63/0x130
 [<ffffffff80573e79>] pci_device_remove+0x39/0xc0
 [<ffffffff80714f46>] __device_release_driver+0x96/0x130
 [<ffffffff80715003>] device_release_driver+0x23/0x30
 [<ffffffff8056d84a>] pci_stop_bus_device+0x8a/0xa0
 [<ffffffff8056d7f1>] pci_stop_bus_device+0x31/0xa0
 [<ffffffff8056d7f1>] pci_stop_bus_device+0x31/0xa0
 [<ffffffff8056d7f1>] pci_stop_bus_device+0x31/0xa0
 [<ffffffff8056d962>] pci_stop_and_remove_bus_device+0x12/0x20
 [<ffffffff80585f0b>] pciehp_unconfigure_device+0x9b/0x180
 [<ffffffff80585a23>] pciehp_disable_slot+0x43/0xb0
 [<ffffffff80585b1d>] pciehp_power_thread+0x8d/0xb0
 [<ffffffff8028aa54>] process_one_work+0x144/0x3c0
 [<ffffffff8028ad1b>] worker_thread+0x4b/0x440
 [<ffffffff8028acd0>] ? process_one_work+0x3c0/0x3c0
 [<ffffffff8028acd0>] ? process_one_work+0x3c0/0x3c0
 [<ffffffff80290269>] kthread+0xc9/0xe0
 [<ffffffff802901a0>] ? kthread_create_on_node+0x180/0x180
 [<ffffffff80b4db2f>] ret_from_fork+0x3f/0x70
 [<ffffffff802901a0>] ? kthread_create_on_node+0x180/0x180
Code: f9 48 89 de e8 fe cd ff ff 4c 89 e6 4c 89 f7 e8 23 92 ff ff 4c 89
ef e8 0b cf ff ff 48 83 c4 10 5b 41 5c 41 5d 41 5e 41 5f 5d c3 <0f> 0b
e8 45 cf ff ff e9 f3 fe ff ff 0f 1f 44 00 00 55 48 8b 76 
RIP  [<ffffffff8061edf4>] intel_unmap+0x1c4/0x1d0
 RSP <ffff8803e465bb98>
---[ end trace ad0596f59dc3d9e0 ]---
BUG: unable to handle kernel paging request at ffffffffffffffd8
IP: [<ffffffff80290881>] kthread_data+0x11/0x20
PGD 120b067 PUD 120d067 PMD 0 
Oops: 0000 [#2] PREEMPT SMP 
Modules linked in: ohci_pci ohci_hcd binfmt_misc netconsole configfs
bbswitch(O) iwlmvm iwlwifi vboxnetadp(O) vboxnetflt(O) vboxdrv(O)
nvidia(PO) vhost_net tun vhost kvm_intel kvm irqbypass dell_smm_hwmon
[last unloaded: netconsole]
CPU: 0 PID: 4857 Comm: kworker/0:3 Tainted: P      D    O    4.4.0-
gentoo #1
Hardware name: Dell Inc. XPS 2720/05R2TK  , BIOS A12 09/21/2015
task: ffff8804070a2300 ti: ffff8803e4658000 task.ti: ffff8803e4658000
RIP: 0010:[<ffffffff80290881>]  [<ffffffff80290881>]
kthread_data+0x11/0x20
RSP: 0018:ffff8803e465b878  EFLAGS: 00010002
RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffff814bd980
RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff8804070a2300
RBP: ffff8803e465b888 R08: 0000000000000000 R09: ffff880468dfe901
R10: 0000000000002800 R11: 000000000000001a R12: 0000000000000000
R13: 00000000000154c0 R14: ffff8804070a2300 R15: ffff88047f2154c0
FS:  0000000000000000(0000) GS:ffff88047f200000(0000)
knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000028 CR3: 000000000120a000 CR4: 00000000001406f0
Stack:
 ffffffff8028b8c1 ffff88047f2154c0 ffff8803e465b8e8 ffffffff80b49c5a
 ffff8803e465b8a8 ffffffff00000000 ffff8804070a2300 ffffffff80275bb8
 0000000000000000 ffff8803e465c000 ffff8803e465b930 ffff8803e465b498
Call Trace:
 [<ffffffff8028b8c1>] ? wq_worker_sleeping+0x11/0x90
 [<ffffffff80b49c5a>] __schedule+0x60a/0xaa0
 [<ffffffff80275bb8>] ? release_task+0x308/0x3e0
 [<ffffffff80b4a12c>] schedule+0x3c/0x90
 [<ffffffff80277242>] do_exit+0x702/0xa90
 [<ffffffff80207989>] oops_end+0x89/0xc0
 [<ffffffff80207beb>] die+0x4b/0x70
 [<ffffffff80204e94>] do_trap+0xb4/0x150
 [<ffffffff80204fa7>] do_error_trap+0x77/0xe0
 [<ffffffff8061edf4>] ? intel_unmap+0x1c4/0x1d0
 [<ffffffff80619eb6>] ? qi_submit_sync+0x2d6/0x3e0
 [<ffffffff80205700>] do_invalid_op+0x20/0x30
 [<ffffffff80b4f188>] invalid_op+0x18/0x20
 [<ffffffff8061edf4>] ? intel_unmap+0x1c4/0x1d0
 [<ffffffff8061ec51>] ? intel_unmap+0x21/0x1d0
 [<ffffffff8061ee8a>] intel_free_coherent+0x5a/0xa0
 [<ffffffffa0ad4d04>] ohci_stop+0x144/0x1c0 [ohci_hcd]
 [<ffffffff807e1fb4>] usb_remove_hcd+0xe4/0x1a0
 [<ffffffff807f2203>] usb_hcd_pci_remove+0x63/0x130
 [<ffffffff80573e79>] pci_device_remove+0x39/0xc0
 [<ffffffff80714f46>] __device_release_driver+0x96/0x130
 [<ffffffff80715003>] device_release_driver+0x23/0x30
 [<ffffffff8056d84a>] pci_stop_bus_device+0x8a/0xa0
 [<ffffffff8056d7f1>] pci_stop_bus_device+0x31/0xa0
 [<ffffffff8056d7f1>] pci_stop_bus_device+0x31/0xa0
 [<ffffffff8056d7f1>] pci_stop_bus_device+0x31/0xa0
 [<ffffffff8056d962>] pci_stop_and_remove_bus_device+0x12/0x20
 [<ffffffff80585f0b>] pciehp_unconfigure_device+0x9b/0x180
 [<ffffffff80585a23>] pciehp_disable_slot+0x43/0xb0
 [<ffffffff80585b1d>] pciehp_power_thread+0x8d/0xb0
 [<ffffffff8028aa54>] process_one_work+0x144/0x3c0
 [<ffffffff8028ad1b>] worker_thread+0x4b/0x440
 [<ffffffff8028acd0>] ? process_one_work+0x3c0/0x3c0
 [<ffffffff8028acd0>] ? process_one_work+0x3c0/0x3c0
 [<ffffffff80290269>] kthread+0xc9/0xe0
 [<ffffffff802901a0>] ? kthread_create_on_node+0x180/0x180
 [<ffffffff80b4db2f>] ret_from_fork+0x3f/0x70
 [<ffffffff802901a0>] ? kthread_create_on_node+0x180/0x180
Code: 02 00 00 00 e8 a1 fd ff ff 5d c3 0f 1f 44 00 00 66 2e 0f 1f 84 00
00 00 00 00 0f 1f 44