From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S261913AbVGRVQq (ORCPT ); Mon, 18 Jul 2005 17:16:46 -0400 Received: (majordomo@vger.kernel.org) by vger.kernel.org id S261916AbVGRVQq (ORCPT ); Mon, 18 Jul 2005 17:16:46 -0400 Received: from mx1.redhat.com ([66.187.233.31]:3750 "EHLO mx1.redhat.com") by vger.kernel.org with ESMTP id S261913AbVGRVQq (ORCPT ); Mon, 18 Jul 2005 17:16:46 -0400 Date: Mon, 18 Jul 2005 14:16:37 -0700 From: Pete Zaitcev To: vojtech@suse.cz Cc: linux-kernel@vger.kernel.org Subject: Fw: Oops in hidinput_hid_event Message-Id: <20050718141637.074c6f70.zaitcev@redhat.com> Organization: Red Hat, Inc. X-Mailer: Sylpheed version 2.0.0beta3 (GTK+ 2.6.7; i686-pc-linux-gnu) Mime-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org X-Mailing-List: linux-kernel@vger.kernel.org I think this patch is rather obvious, so maybe I should ask Andrew to apply it to -mm for now, to get some testing. Would that help to verify it for acceptance? -- Pete Begin forwarded message: Date: Tue, 28 Jun 2005 15:00:23 -0700 From: Pete Zaitcev To: vojtech@suse.cz Cc: zaitcev@redhat.com, linux-usb-devel@lists.sourceforge.net Subject: Oops in hidinput_hid_event Hi, Vojtech: Someone reported a bug in Fedora, which runs a largely unmodified upstream kernel in this area. Whenever the user hits a key which switches LED, the system oopses. Here's a trace: Unable to handle kernel NULL pointer dereference at virtual address 000000c8 EFLAGS: 00010006 (2.6.11-1.1369_FC4smp) EIP is at hidinput_hid_event+0x2d/0x292 Call Trace: [] hid_process_event+0x57/0x5f [] hid_input_field+0x2a2/0x2ac [] hid_input_report+0x9e/0xb8 [] hid_ctrl+0x14c/0x151 [] uhci_destroy_urb_priv+0xb5/0x10a [uhci_hcd] [] usb_hcd_giveback_urb+0x24/0x67 [] uhci_finish_urb+0x2d/0x38 [uhci_hcd] [] uhci_finish_completion+0x44/0x56 [uhci_hcd] [] uhci_scan_schedule+0xaa/0x13a [uhci_hcd] [] i8042_interrupt+0x121/0x234 [] uhci_irq+0x47/0x10d [uhci_hcd] Full trace at https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=160709 Any ideas? By the way, it seems that I see a bug in hidinput_hid_event. The check for NULL can never work, becaue &hidinput->input is nonzero at all times. How about this? --- linux-2.6.12/drivers/usb/input/hid-input.c 2005-06-21 12:58:47.000000000 -0700 +++ linux-2.6.12-lem/drivers/usb/input/hid-input.c 2005-06-28 14:57:22.000000000 -0700 @@ -397,11 +397,12 @@ void hidinput_hid_event(struct hid_device *hid, struct hid_field *field, struct hid_usage *usage, __s32 value, struct pt_regs *regs) { - struct input_dev *input = &field->hidinput->input; + struct input_dev *input; int *quirks = &hid->quirks; - if (!input) + if (!field->hidinput) return; + input = &field->hidinput->input; input_regs(input, regs); -- Pete