linux-kernel - Re: crash by cdc_acm driver in kernels 4.8-rc1/5

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20160928150856.GA1424@djo.tudelft.nl>
Date:   Wed, 28 Sep 2016 17:08:56 +0200
From:   Wim Osterholt <wim@....tudelft.nl>
To:     Oliver Neukum <oneukum@...e.com>
Cc:     linux-kernel@...r.kernel.org, linux-usb@...r.kernel.org,
        Wim Osterholt <wim@....tudelft.nl>
Subject: Re: crash by cdc_acm driver in kernels 4.8-rc1/5

On Wed, Sep 28, 2016 at 11:16:04AM +0200, Oliver Neukum wrote:
> this should show you where it crashes. In addition I've attached
> a patch with paranoid debugging. Could you compile and test a kernel
> with it?
> 
> 	Regards
> 		Oliver

If you mean
  echo "module cdc_acm +mpf" > /sys/kernel/debug/dynamic_debug/control
etc, then it will take some time because I don't have the cabling not
available now for a serial dump.

Just 4.8-rc8 with the patched modules gave an oops of less than one screen
while the machine stayed responsive long enough to grab it with the mouse
and put it in a file:

HP src # sync
HP src # [ 3744.914184] BUG: unable to handle kernel NULL pointer dereference at 00000249
[ 3744.914538] IP: [<e092fcb6>] acm_probe+0x52d/0xced [cdc_acm]
[ 3744.914850] *pde = 00000000
[ 3744.915133] Oops: 0000 [#1] SMP
[ 3744.915446] Modules linked in: cdc_acm(+) nouveau video drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops ttm drm agpgart i2c_algo_bit cfg80211 rfkill binfmt_misc svgalib_helper(O) snd_pcm_oss snd_mixer_oss fbcon bitblit softcursor font tileblit sr9700 dm9601 snd_hda_codec_generic usb_storage usbnet snd_hda_intel mii snd_hda_codec tg3 snd_hwdep snd_hda_core ptp pps_core snd_pcm libphy gpio_ich firmware_class snd_timer lpc_ich pcspkr ppdev ohci_pci snd ohci_hcd wmi mfd_core uhci_hcd floppy parport_pc soundcore ehci_pci parport acpi_cpufreq ehci_hcd button processor
[ 3744.918142] CPU: 1 PID: 24530 Comm: udevd Tainted: G           O    4.8.0-rc8 #1
[ 3744.918142] Hardware name: Hewlett-Packard HP xw4300 Workstation/0A00h, BIOS 786D3 v01.08 03/10/2006
[ 3744.918142] task: df7b4d00 task.stack: d3d56000
[ 3744.918142] EIP: 0060:[<e092fcb6>] EFLAGS: 00010202 CPU: 1
[ 3744.918142] EIP is at acm_probe+0x52d/0xced [cdc_acm]
[ 3744.918142] EAX: 00000246 EBX: cf9a7800 ECX: e09318d4 EDX: 00000000
[ 3744.918142] ESI: 00000100 EDI: 00000000 EBP: d3d57cc8 ESP: d3d57c30
[ 3744.918142]  DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068
[ 3744.918142] CR0: 80050033 CR2: 00000249 CR3: 1ac9a000 CR4: 00000690
[ 3744.918142] Stack:
[ 3744.918142]  00003a20 00003d7b 0000000f df4a9d50 00000000 00000000 00000010 00000040
[ 3744.918142]  00000080 00000246 dedeb200 dac90740 cfa40870 00000001 ceb37180 cfa40800
[ 3744.918142]  ceb371b8 dedeaa00 dedeb200 00000000 cabfe3f0 00000004 00000246 d3d57cb0
[ 3744.918142] Call Trace:
[ 3744.918142]  [<c04cee8d>] ? __mutex_unlock_slowpath+0xf4/0xfc
[ 3744.918142]  [<c03cda6c>] ? usb_probe_interface+0x17b/0x1f6
[ 3744.918142]  [<c03cda6c>] ? usb_probe_interface+0x17b/0x1f6
[ 3744.918142]  [<c0361090>] ? driver_probe_device+0x17b/0x30e
[ 3744.918142]  [<c0361090>] ? driver_probe_device+0x17b/0x30e
[ 3744.918142]  [<c03612d2>] ? __driver_attach+0xaf/0xd2
[ 3744.918142]  [<c03612d2>] ? __driver_attach+0xaf/0xd2
[ 3744.918142]  [<c04ca8ea>] ? klist_next+0x2a/0xad
[ 3744.918142]  [<c035f6fd>] ? bus_for_each_dev+0x50/0x6c
[ 3744.918142]  [<c035f6fd>] ? bus_for_each_dev+0x50/0x6c
[ 3744.918142]  [<c0360b00>] ? driver_attach+0x19/0x1b
[ 3744.918142]  [<c0361223>] ? driver_probe_device+0x30e/0x30e
[ 3744.918142]  [<c036066c>] ? bus_add_driver+0x10a/0x1ee
[ 3744.918142]  [<c02cbb06>] ? kset_find_obj+0x2b/0x5f
[ 3744.918142]  [<c0361aea>] ? driver_register+0x74/0xa9
[ 3744.918142]  [<c0361aea>] ? driver_register+0x74/0xa9
[ 3744.918142]  [<c03ccb17>] ? usb_register_driver+0x67/0xf8
[ 3744.918142]  [<e09340ac>] ? acm_init+0xac/0xdf [cdc_acm]
[ 3744.918142]  [<e0934000>] ? 0xe0934000
[ 3744.918142]  [<c01004cb>] ? do_one_initcall+0x90/0x113
[ 3744.918142]  [<c04cee8d>] ? __mutex_unlock_slowpath+0xf4/0xfc
[ 3744.918142]  [<c01e1bc6>] ? kmem_cache_alloc_trace+0x72/0xe3
[ 3744.918142]  [<c01b24a1>] ? do_init_module+0x21/0x1a7
[ 3744.918142]  [<c01b24d0>] ? do_init_module+0x50/0x1a7
[ 3744.918142]  [<c0189c32>] ? load_module+0x190e/0x1d33
[ 3744.918142]  [<c018a1d7>] ? SyS_finit_module+0x9c/0xa8
[ 3744.918142]  [<c018a1d7>] ? SyS_finit_module+0x9c/0xa8
[ 3744.918142]  [<c0101363>] ? do_int80_syscall_32+0x47/0x7f
[ 3744.918142]  [<c0101363>] ? do_int80_syscall_32+0x47/0x7f
[ 3744.918142]  [<c04d0785>] ? entry_INT80_32+0x31/0x31
[ 3744.918142] Code: 14 89 83 b4 04 00 00 8b 45 90 89 43 04 8b 45 ac 89 43 08 8b 85 7c ff ff ff 89 83 c0 04 00 00 8b 45 a4 89 03 8b 45 c0 85 c0 74 0a <0f> b6 40 03 89 83 c8 04 00 00 f6 45 9c 04 74 07 83 a3 c8 04 00
[ 3744.918142] EIP: [<e092fcb6>] acm_probe+0x52d/0xced [cdc_acm] SS:ESP 0068:d3d57c30
[ 3744.918142] CR2: 0000000000000249
[ 3745.000049] ---[ end trace e6bc96526d51607e ]---
[ 3745.006322] udevd[945]: worker [24530] terminated by signal 9 (Killed)
[ 3745.008927] udevd[945]: worker [24530] failed while handling '/devices/pci0000:00/0000:00:1d.3/usb6/6-1/6-1:1.0'


Regards, Wim.