linux-kernel - Re: [RFC PATCH] usb: dwc3: gadget: Fix NULL pointer dereference in dwc3_gadget

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <34621658-0626-82cc-a641-3c25af3ea9f3@quicinc.com>
Date: Wed, 17 Jan 2024 12:06:22 +0530
From: UTTKARSH AGGARWAL <quic_uaggarwa@...cinc.com>
To: Thinh Nguyen <Thinh.Nguyen@...opsys.com>
CC: Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        "linux-usb@...r.kernel.org" <linux-usb@...r.kernel.org>
Subject: Re: [RFC PATCH] usb: dwc3: gadget: Fix NULL pointer dereference in
 dwc3_gadget_suspend


On 1/17/2024 6:49 AM, Thinh Nguyen wrote:
> Do you have the dmesg log of this NULL pointer dereference?
> Thanks,
> Thinh

Hi Thinh,

Here is the dmesg log:

[  149.524338][  T843] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000028
…
[  149.525872][  T843] Workqueue: pm pm_runtime_work
[  149.525886][  T843] pstate: 824000c5 (Nzcv daIF +PAN -UAO +TCO -DIT -SSBS BTYPE=--)
[  149.525893][  T843] pc : dwc3_gadget_suspend+0x4c/0xb8
[  149.525900][  T843] lr : dwc3_gadget_suspend+0x34/0xb8
…
[  149.526003][  T843] Call trace:
[  149.526008][  T843]  dwc3_gadget_suspend+0x4c/0xb8
[  149.526015][  T843]  dwc3_suspend_common+0x58/0x230
[  149.526021][  T843]  dwc3_runtime_suspend+0x34/0x50
[  149.526027][  T843]  pm_generic_runtime_suspend+0x40/0x58
[  149.526034][  T843]  __rpm_callback+0x94/0x3e0
[  149.526040][  T843]  rpm_suspend+0x2e4/0x720
[  149.526047][  T843]  __pm_runtime_suspend+0x6c/0x100
[  149.526054][  T843]  dwc3_runtime_idle+0x48/0x64
[  149.526060][  T843]  rpm_idle+0x20c/0x310
[  149.526067][  T843]  pm_runtime_work+0x80/0xac
[  149.526075][  T843]  process_one_work+0x1e4/0x43c
[  149.526084][  T843]  worker_thread+0x25c/0x430
[  149.526091][  T843]  kthread+0x104/0x1d4
[  149.526099][  T843]  ret_from_fork+0x10/0x20
  
=======================================================
Process: adbd, [affinity: 0xff] cpu: 6 pid: 4907 start: 0xffffff888079b840
=====================================================
    Task name: adbd [affinity: 0xff] pid: 4907 cpu: 6 prio: 120 start: ffffff888079b840
    state: 0x2[D] exit_state: 0x0 stack base: 0xffffffc02db20000
    Last_enqueued_ts:     149.523808841 Last_sleep_ts:     149.523859362
    Stack:
    [<ffffffc0091cd558>] __switch_to+0x174
    [<ffffffc0091cdd40>] __schedule+0x5ec
    [<ffffffc0091ce19c>] schedule+0x7c
    [<ffffffc0091d7438>] schedule_timeout+0x44
    [<ffffffc0091ce858>] wait_for_common+0xd8
    [<ffffffc0091ce774>] wait_for_completion+0x18
    [<ffffffc0082b23dc>] kthread_stop+0x78
    [<ffffffc0083134a0>] free_irq+0x184
    [<ffffffc008bc7438>] dwc3_gadget_stop+0x40
    [<ffffffc008c12228>] gadget_unbind_driver+0xfc
    [<ffffffc008ab76ac>] device_release_driver_internal[jt]+0x1d4
    [<ffffffc008ab78dc>] driver_detach+0x90
    [<ffffffc008ab519c>] bus_remove_driver+0x78
    [<ffffffc008ab9170>] driver_unregister[jt]+0x44
    [<ffffffc008c11838>] usb_gadget_unregister_driver+0x20
    [<ffffffc008c0c1e0>] unregister_gadget_item+0x30
    [<ffffffc008c256a8>] ffs_data_clear[jt]+0x88

Thanks,

Uttkarsh