lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite for Android: free password hash cracker in your pocket
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <CAKzKK0r3P0zbN3ib_qPoGqqbdPSX8YeC=0QwKnZoDbfex8hvHQ@mail.gmail.com>
Date: Wed, 17 Jan 2024 14:49:46 +0800
From: Kuen-Han Tsai <khtsai@...gle.com>
To: UTTKARSH AGGARWAL <quic_uaggarwa@...cinc.com>
Cc: Thinh Nguyen <Thinh.Nguyen@...opsys.com>, 
	Greg Kroah-Hartman <gregkh@...uxfoundation.org>, 
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>, 
	"linux-usb@...r.kernel.org" <linux-usb@...r.kernel.org>
Subject: Re: [RFC PATCH] usb: dwc3: gadget: Fix NULL pointer dereference in dwc3_gadget_suspend

Hi Uttkarsh and Thinh,

>> Call Stack:
>> CPU1:                             CPU2:
>> gadget_unbind_driver     dwc3_suspend_common
>> dw3_gadget_stop           dwc3_gadget_suspend
>>                                        dwc3_disconnect_gadget

typo: dw3_gadget_stop/dwc3_gadget_stop

> Do you have the dmesg log of this NULL pointer dereference?
> Thanks,
> Thinh

We also encountered similar stack traces.

[    5.130593][  T100] Unable to handle kernel NULL pointer
dereference at virtual address 0000000000000028
[    5.130912][  T100] Call trace:
[    5.130914][  T100]  dwc3_gadget_suspend+0x88/0xf0
[    5.130918][  T100]  dwc3_suspend_common+0x58/0x230
[    5.130921][  T100]  dwc3_runtime_suspend+0x34/0x50
[    5.130925][  T100]  pm_generic_runtime_suspend+0x40/0x58
[    5.130928][  T100]  __rpm_callback+0x94/0x3e0
[    5.130931][  T100]  rpm_suspend+0x2e4/0x720
[    5.130934][  T100]  __pm_runtime_suspend+0x6c/0x100
[    5.130937][  T100]  dwc3_runtime_idle+0x48/0x64
[    5.130941][  T100]  rpm_idle+0x20c/0x310
[    5.130944][  T100]  pm_runtime_work+0x80/0xac
[    5.130947][  T100]  process_one_work+0x1e4/0x43c
[    5.130952][  T100]  worker_thread+0x25c/0x430
[    5.130956][  T100]  kthread+0x104/0x1d4
[    5.130959][  T100]  ret_from_fork+0x10/0x20

(gdb) list *dwc3_gadget_suspend+0x88
0xffffffc0089b2318 is in dwc3_gadget_suspend (drivers/usb/dwc3/gadget.c:3729).
..
3729            if (dwc->async_callbacks && dwc->gadget_driver->disconnect) {
..

Thanks,
Kuen-Han

Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ