From: Greg KH <gregkh@suse.de>
To: linux-kernel@vger.kernel.org, stable@kernel.org
Cc: stable-review@kernel.org, torvalds@linux-foundation.org,
akpm@linux-foundation.org, alan@lxorguk.ukuu.org.uk,
Johan Hovold <jhovold@gmail.com>
Subject: [46/63] USB: cdc-acm: fix memory corruption / panic
Date: Fri, 25 Mar 2011 16:44:22 -0700 [thread overview]
Message-ID: <20110325234512.646048952@clark.kroah.org> (raw)
In-Reply-To: <20110325234526.GA18017@kroah.com>
2.6.38-stable review patch. If anyone has any objections, please let us know.
------------------
From: Johan Hovold <jhovold@gmail.com>
commit 23b80550e2aa61d0ba3af98b831b9195be0db9ee upstream.
Prevent read urbs from being resubmitted from tasklet after port close.
The receive tasklet was not disabled on port close, which could lead to
corruption of receive lists on consecutive port open. In particular,
read urbs could be re-submitted before port open, added to free list in
open, and then added a second time to the free list in the completion
handler.
cdc-acm.c: Entering acm_tty_open.
cdc-acm.c: acm_control_msg: rq: 0x22 val: 0x3 len: 0x0 result: 0
cdc-acm.c: Entering acm_rx_tasklet
cdc-acm.c: acm_rx_tasklet: sending urb 0xf50da280, rcv 0xf57fbc24, buf 0xf57fbd64
cdc-acm.c: set line: 115200 0 0 8
cdc-acm.c: acm_control_msg: rq: 0x20 val: 0x0 len: 0x7 result: 7
cdc-acm.c: acm_tty_close
cdc-acm.c: acm_port_down
cdc-acm.c: acm_control_msg: rq: 0x22 val: 0x0 len: 0x0 result: 0
cdc-acm.c: acm_ctrl_irq - urb shutting down with status: -2
cdc-acm.c: acm_rx_tasklet: sending urb 0xf50da300, rcv 0xf57fbc10, buf 0xf57fbd50
cdc-acm.c: Entering acm_read_bulk with status -2
cdc_acm 4-1:1.1: Aborting, acm not ready
cdc-acm.c: Entering acm_read_bulk with status -2
cdc_acm 4-1:1.1: Aborting, acm not ready
cdc-acm.c: acm_rx_tasklet: sending urb 0xf50da380, rcv 0xf57fbbfc, buf 0xf57fbd3c
cdc-acm.c: acm_rx_tasklet: sending urb 0xf50da400, rcv 0xf57fbbe8, buf 0xf57fbd28
cdc-acm.c: acm_rx_tasklet: sending urb 0xf50da480, rcv 0xf57fbbd4, buf 0xf57fbd14
cdc-acm.c: acm_rx_tasklet: sending urb 0xf50da900, rcv 0xf57fbbc0, buf 0xf57fbd00
cdc-acm.c: acm_rx_tasklet: sending urb 0xf50da980, rcv 0xf57fbbac, buf 0xf57fbcec
cdc-acm.c: acm_rx_tasklet: sending urb 0xf50daa00, rcv 0xf57fbb98, buf 0xf57fbcd8
cdc-acm.c: acm_rx_tasklet: sending urb 0xf50daa80, rcv 0xf57fbb84, buf 0xf57fbcc4
cdc-acm.c: acm_rx_tasklet: sending urb 0xf50dab00, rcv 0xf57fbb70, buf 0xf57fbcb0
cdc-acm.c: acm_rx_tasklet: sending urb 0xf50dab80, rcv 0xf57fbb5c, buf 0xf57fbc9c
cdc-acm.c: acm_rx_tasklet: sending urb 0xf50dac00, rcv 0xf57fbb48, buf 0xf57fbc88
cdc-acm.c: acm_rx_tasklet: sending urb 0xf50dac80, rcv 0xf57fbb34, buf 0xf57fbc74
cdc-acm.c: acm_rx_tasklet: sending urb 0xf50dad00, rcv 0xf57fbb20, buf 0xf57fbc60
cdc-acm.c: acm_rx_tasklet: sending urb 0xf50dad80, rcv 0xf57fbb0c, buf 0xf57fbc4c
cdc-acm.c: acm_rx_tasklet: sending urb 0xf50da880, rcv 0xf57fbaf8, buf 0xf57fbc38
cdc-acm.c: Entering acm_tty_open.
cdc-acm.c: acm_control_msg: rq: 0x22 val: 0x3 len: 0x0 result: 0
cdc-acm.c: Entering acm_rx_tasklet
cdc-acm.c: acm_rx_tasklet: sending urb 0xf50da280, rcv 0xf57fbc24, buf 0xf57fbd64
cdc-acm.c: Entering acm_tty_write to write 3 bytes,
cdc-acm.c: Get 3 bytes...
cdc-acm.c: acm_write_start susp_count: 0
cdc-acm.c: Entering acm_read_bulk with status 0
------------[ cut here ]------------
WARNING: at /home/johan/src/linux/linux-2.6/lib/list_debug.c:57 list_del+0x10c/0x120()
Hardware name: Vostro 1520
list_del corruption. next->prev should be f57fbc10, but was f57fbaf8
Modules linked in: cdc_acm
Pid: 3, comm: ksoftirqd/0 Not tainted 2.6.37+ #39
Call Trace:
[<c103c7e2>] warn_slowpath_common+0x72/0xa0
[<c11dd8ac>] ? list_del+0x10c/0x120
[<c11dd8ac>] ? list_del+0x10c/0x120
[<c103c8b3>] warn_slowpath_fmt+0x33/0x40
[<c11dd8ac>] list_del+0x10c/0x120
[<f8051dbf>] acm_rx_tasklet+0xef/0x3e0 [cdc_acm]
[<c135465d>] ? net_rps_action_and_irq_enable+0x6d/0x80
[<c1042bb6>] tasklet_action+0xe6/0x140
[<c104342f>] __do_softirq+0xaf/0x210
[<c1043380>] ? __do_softirq+0x0/0x210
<IRQ> [<c1042c9a>] ? run_ksoftirqd+0x8a/0x1c0
[<c1042c10>] ? run_ksoftirqd+0x0/0x1c0
[<c105ac24>] ? kthread+0x74/0x80
[<c105abb0>] ? kthread+0x0/0x80
[<c100337a>] ? kernel_thread_helper+0x6/0x10
---[ end trace efd9a11434f0082e ]---
------------[ cut here ]------------
WARNING: at /home/johan/src/linux/linux-2.6/lib/list_debug.c:57 list_del+0x10c/0x120()
Hardware name: Vostro 1520
list_del corruption. next->prev should be f57fbd50, but was f57fbdb0
Modules linked in: cdc_acm
Pid: 3, comm: ksoftirqd/0 Tainted: G W 2.6.37+ #39
Call Trace:
[<c103c7e2>] warn_slowpath_common+0x72/0xa0
[<c11dd8ac>] ? list_del+0x10c/0x120
[<c11dd8ac>] ? list_del+0x10c/0x120
[<c103c8b3>] warn_slowpath_fmt+0x33/0x40
[<c11dd8ac>] list_del+0x10c/0x120
[<f8051dd6>] acm_rx_tasklet+0x106/0x3e0 [cdc_acm]
[<c135465d>] ? net_rps_action_and_irq_enable+0x6d/0x80
[<c1042bb6>] tasklet_action+0xe6/0x140
[<c104342f>] __do_softirq+0xaf/0x210
[<c1043380>] ? __do_softirq+0x0/0x210
<IRQ> [<c1042c9a>] ? run_ksoftirqd+0x8a/0x1c0
[<c1042c10>] ? run_ksoftirqd+0x0/0x1c0
[<c105ac24>] ? kthread+0x74/0x80
[<c105abb0>] ? kthread+0x0/0x80
[<c100337a>] ? kernel_thread_helper+0x6/0x10
---[ end trace efd9a11434f0082f ]---
cdc-acm.c: acm_rx_tasklet: sending urb 0xf50da300, rcv 0xf57fbc10, buf 0xf57fbd50
cdc-acm.c: disconnected from network
cdc-acm.c: acm_rx_tasklet: sending urb 0xf50da380, rcv 0xf57fbbfc, buf 0xf57fbd3c
cdc-acm.c: Entering acm_rx_tasklet
------------[ cut here ]------------
WARNING: at /home/johan/src/linux/linux-2.6/lib/list_debug.c:48 list_del+0xd5/0x120()
Hardware name: Vostro 1520
list_del corruption, next is LIST_POISON1 (00100100)
Modules linked in: cdc_acm
Pid: 3, comm: ksoftirqd/0 Tainted: G W 2.6.37+ #39
Call Trace:
[<c103c7e2>] warn_slowpath_common+0x72/0xa0
[<c11dd875>] ? list_del+0xd5/0x120
[<c11dd875>] ? list_del+0xd5/0x120
[<c103c8b3>] warn_slowpath_fmt+0x33/0x40
[<c11dd875>] list_del+0xd5/0x120
[<f8051fac>] acm_rx_tasklet+0x2dc/0x3e0 [cdc_acm]
[<c106dbab>] ? trace_hardirqs_on+0xb/0x10
[<c1042b30>] ? tasklet_action+0x60/0x140
[<c1042bb6>] tasklet_action+0xe6/0x140
[<c104342f>] __do_softirq+0xaf/0x210
[<c1043380>] ? __do_softirq+0x0/0x210
<IRQ> [<c1042c9a>] ? run_ksoftirqd+0x8a/0x1c0
[<c1042c10>] ? run_ksoftirqd+0x0/0x1c0
[<c105ac24>] ? kthread+0x74/0x80
[<c105abb0>] ? kthread+0x0/0x80
[<c100337a>] ? kernel_thread_helper+0x6/0x10
---[ end trace efd9a11434f00830 ]---
BUG: unable to handle kernel paging request at 00200200
IP: [<c11dd7bd>] list_del+0x1d/0x120
*pde = 00000000
Oops: 0000 [#1] PREEMPT SMP
last sysfs file: /sys/devices/pci0000:00/0000:00:1a.1/usb4/4-1/4-1:1.0/tty/ttyACM0/uevent
Modules linked in: cdc_acm
Pid: 3, comm: ksoftirqd/0 Tainted: G W 2.6.37+ #39 0T816J/Vostro 1520
EIP: 0060:[<c11dd7bd>] EFLAGS: 00010046 CPU: 0
EIP is at list_del+0x1d/0x120
EAX: f57fbd3c EBX: f57fb800 ECX: ffff8000 EDX: 00200200
ESI: f57fbe90 EDI: f57fbd3c EBP: f600bf54 ESP: f600bf3c
DS: 007b ES: 007b FS: 00d8 GS: 0000 SS: 0068
Process ksoftirqd/0 (pid: 3, ti=f600a000 task=f60791c0 task.ti=f6082000)
Stack:
c1527e84 00000030 c1527e54 00100100 f57fb800 f57fbd3c f600bf98 f8051fac
f8053104 f8052b94 f600bf6c c106dbab f600bf80 00000286 f60791c0 c1042b30
f57fbda8 f57f5800 f57fbdb0 f57fbd80 f57fbe7c c1656b04 00000000 f600bfb0
Call Trace:
[<f8051fac>] ? acm_rx_tasklet+0x2dc/0x3e0 [cdc_acm]
[<c106dbab>] ? trace_hardirqs_on+0xb/0x10
[<c1042b30>] ? tasklet_action+0x60/0x140
[<c1042bb6>] ? tasklet_action+0xe6/0x140
[<c104342f>] ? __do_softirq+0xaf/0x210
[<c1043380>] ? __do_softirq+0x0/0x210
<IRQ>
[<c1042c9a>] ? run_ksoftirqd+0x8a/0x1c0
[<c1042c10>] ? run_ksoftirqd+0x0/0x1c0
[<c105ac24>] ? kthread+0x74/0x80
[<c105abb0>] ? kthread+0x0/0x80
[<c100337a>] ? kernel_thread_helper+0x6/0x10
Code: ff 48 14 e9 57 ff ff ff 90 90 90 90 90 90 55 89 e5 83 ec 18 81 38 00 01 10 00 0f 84 9c 00 00 00 8b 50 04 81 fa 00 02 20 00 74 33 <8b> 12 39 d0 75 5c 8b 10 8b 4a 04 39 c8 0f 85 b5 00 00 00 8b 48
EIP: [<c11dd7bd>] list_del+0x1d/0x120 SS:ESP 0068:f600bf3c
CR2: 0000000000200200
---[ end trace efd9a11434f00831 ]---
Kernel panic - not syncing: Fatal exception in interrupt
Pid: 3, comm: ksoftirqd/0 Tainted: G D W 2.6.37+ #39
Call Trace:
[<c13fede1>] ? printk+0x1d/0x24
[<c13fecce>] panic+0x66/0x15c
[<c10067df>] oops_end+0x8f/0x90
[<c1025476>] no_context+0xc6/0x160
[<c10255a8>] __bad_area_nosemaphore+0x98/0x140
[<c103cf68>] ? release_console_sem+0x1d8/0x210
[<c1025667>] bad_area_nosemaphore+0x17/0x20
[<c1025a49>] do_page_fault+0x279/0x420
[<c1006a8f>] ? show_trace+0x1f/0x30
[<c13fede1>] ? printk+0x1d/0x24
[<c10257d0>] ? do_page_fault+0x0/0x420
[<c140333b>] error_code+0x5f/0x64
[<c103007b>] ? select_task_rq_fair+0x37b/0x6a0
[<c10257d0>] ? do_page_fault+0x0/0x420
[<c11dd7bd>] ? list_del+0x1d/0x120
[<f8051fac>] acm_rx_tasklet+0x2dc/0x3e0 [cdc_acm]
[<c106dbab>] ? trace_hardirqs_on+0xb/0x10
[<c1042b30>] ? tasklet_action+0x60/0x140
[<c1042bb6>] tasklet_action+0xe6/0x140
[<c104342f>] __do_softirq+0xaf/0x210
[<c1043380>] ? __do_softirq+0x0/0x210
<IRQ> [<c1042c9a>] ? run_ksoftirqd+0x8a/0x1c0
[<c1042c10>] ? run_ksoftirqd+0x0/0x1c0
[<c105ac24>] ? kthread+0x74/0x80
[<c105abb0>] ? kthread+0x0/0x80
[<c100337a>] ? kernel_thread_helper+0x6/0x10
panic occurred, switching back to text console
------------[ cut here ]------------
Signed-off-by: Johan Hovold <jhovold@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
drivers/usb/class/cdc-acm.c | 2 ++
1 file changed, 2 insertions(+)
--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -646,8 +646,10 @@ static void acm_port_down(struct acm *ac
usb_kill_urb(acm->ctrlurb);
for (i = 0; i < ACM_NW; i++)
usb_kill_urb(acm->wb[i].urb);
+ tasklet_disable(&acm->urb_task);
for (i = 0; i < nr; i++)
usb_kill_urb(acm->ru[i].urb);
+ tasklet_enable(&acm->urb_task);
acm->control->needs_remote_wakeup = 0;
usb_autopm_put_interface(acm->control);
}
next prev parent reply other threads:[~2011-03-26 0:14 UTC|newest]
Thread overview: 64+ messages / expand[flat|nested] mbox.gz Atom feed top
2011-03-25 23:45 [00/63] 2.6.38.2-stable review Greg KH
2011-03-25 23:43 ` [01/63] ALSA: HDA: Realtek: Avoid unnecessary volume control index on Surround/Side Greg KH
2011-03-25 23:43 ` [02/63] ALSA: hda - VIA: Fix stereo mixer recording no sound issue Greg KH
2011-03-25 23:43 ` [03/63] ALSA: hda - VIA: Fix independent headphone " Greg KH
2011-03-25 23:43 ` [04/63] ALSA: hda - VIA: Add missing support for VT1718S in A-A path Greg KH
2011-03-25 23:43 ` [05/63] ALSA: hda - VIA: Fix invalid A-A path volume adjust issue Greg KH
2011-03-25 23:43 ` [06/63] ALSA: hda - VIA: Fix codec type for VT1708BCE at the right timing Greg KH
2011-03-25 23:43 ` [07/63] ALSA: hda - VIA: Fix VT1708 cant build up Headphone control issue Greg KH
2011-03-25 23:43 ` [08/63] ASoC: mini2440: Fix uda134x codec problem Greg KH
2011-03-25 23:43 ` [09/63] ethtool: Compat handling for struct ethtool_rxnfc Greg KH
2011-03-25 23:43 ` [10/63] Revert "slab: Fix missing DEBUG_SLAB last user" Greg KH
2011-03-25 23:43 ` [11/63] aio: wake all waiters when destroying ctx Greg KH
2011-03-25 23:43 ` [12/63] cgroups: if you list_empty() a head then dont list_del() it Greg KH
2011-03-25 23:43 ` [13/63] shmem: let shared anonymous be nonlinear again Greg KH
2011-03-25 23:43 ` [14/63] mm: swap: unlock swapfile inode mutex before closing file on bad swapfiles Greg KH
2011-03-25 23:43 ` [15/63] mm: compaction: prevent kswapd compacting memory to reduce CPU usage Greg KH
2011-03-25 23:43 ` [16/63] oom: prevent unnecessary oom kills or kernel panics Greg KH
2011-03-25 23:43 ` [17/63] oom: skip zombies when iterating tasklist Greg KH
2011-03-25 23:43 ` [18/63] oom: avoid deferring oom killer if exiting task is being traced Greg KH
2011-03-25 23:43 ` [19/63] PCI hotplug: acpiphp: set current_state to D0 in register_slot Greg KH
2011-03-25 23:43 ` [20/63] Input: xen-kbdfront - advertise either absolute or relative coordinates Greg KH
2011-03-25 23:43 ` [21/63] xen: set max_pfn_mapped to the last pfn mapped Greg KH
2011-03-25 23:43 ` [22/63] Prevent rt_sigqueueinfo and rt_tgsigqueueinfo from spoofing the signal code Greg KH
2011-03-25 23:43 ` [23/63] ALSA: HDA: Fix internal mic on Dell E5420/E5520 Greg KH
2011-03-25 23:44 ` [24/63] mm: PageBuddy and mapcount robustness Greg KH
2011-03-25 23:44 ` [25/63] ext3: skip orphan cleanup on rocompat fs Greg KH
2011-03-25 23:44 ` [26/63] x86: Fix binutils-2.21 symbol related build failures Greg KH
2011-03-25 23:44 ` [27/63] sysctl: restrict write access to dmesg_restrict Greg KH
2011-03-25 23:44 ` [28/63] procfs: fix /proc/<pid>/maps heap check Greg KH
2011-03-25 23:44 ` [29/63] proc: protect mm start_code/end_code in /proc/pid/stat Greg KH
2011-03-25 23:44 ` [30/63] fbcon: Bugfix soft cursor detection in Tile Blitting Greg KH
2011-03-25 23:44 ` [31/63] nfsd41: modify the members value of nfsd4_op_flags Greg KH
2011-03-25 23:44 ` [32/63] nfsd4: minor nfs4state.c reshuffling Greg KH
2011-03-25 23:44 ` [33/63] nfsd4: fix struct file leak Greg KH
2011-03-25 23:44 ` [34/63] nfsd: wrong index used in inner loop Greg KH
2011-03-25 23:44 ` [35/63] [media] uvcvideo: Fix uvc_fixup_video_ctrl() format search Greg KH
2011-03-25 23:44 ` [36/63] [media] uvcvideo: Fix descriptor parsing for video output devices Greg KH
2011-03-25 23:44 ` [37/63] sh: Fix ptrace fpu state initialisation Greg KH
2011-03-25 23:44 ` [38/63] sh: Fix ptrace hw_breakpoint handling Greg KH
2011-03-25 23:44 ` [39/63] USB: Do not pass negative length to snoop_urb() Greg KH
2011-03-25 23:44 ` [40/63] ehci-hcd: Bug fix: dont set a QHs Halt bit Greg KH
2011-03-25 23:44 ` [41/63] usb: musb: blackfin: fix typo in platform driver name Greg KH
2011-03-25 23:44 ` [42/63] usb: musb: blackfin: fix typo in new dev_pm_ops struct Greg KH
2011-03-25 23:44 ` [43/63] usb: musb: blackfin: fix typo in new bfin_musb_vbus_status func Greg KH
2011-03-25 23:44 ` [44/63] USB: uss720 fixup refcount position Greg KH
2011-03-25 23:44 ` [45/63] USB: Fix bad dma problem on WDM device disconnect Greg KH
2011-03-25 23:44 ` Greg KH [this message]
2011-03-25 23:44 ` [47/63] USB: cdc-acm: fix potential null-pointer dereference Greg KH
2011-03-25 23:44 ` [48/63] USB: cdc-acm: fix potential null-pointer dereference on disconnect Greg KH
2011-03-25 23:44 ` [49/63] fix deadlock in pivot_root() Greg KH
2011-03-25 23:44 ` [50/63] fs: assign sb->s_bdi to default_backing_dev_info if the bdi is going away Greg KH
2011-03-25 23:44 ` [51/63] x86: Cleanup highmap after brk is concluded Greg KH
2011-03-25 23:44 ` [52/63] drm: check for modesetting on modeset ioctls Greg KH
2011-03-25 23:44 ` [53/63] drm/i915: Disable pagefaults along execbuffer relocation fast path Greg KH
2011-03-25 23:44 ` [54/63] drm/i915: Prevent racy removal of request from client list Greg KH
2011-03-25 23:44 ` [55/63] drm: Fix use-after-free in drm_gem_vm_close() Greg KH
2011-03-25 23:44 ` [56/63] drm/radeon/kms: prefer legacy pll algo for tv-out Greg KH
2011-03-25 23:44 ` [57/63] drm/radeon/kms: fix hardcoded EDID handling Greg KH
2011-03-25 23:44 ` [58/63] perf: Fix tear-down of inherited group events Greg KH
2011-03-25 23:44 ` [59/63] NFS: Fix a hang/infinite loop in nfs_wb_page() Greg KH
2011-03-25 23:44 ` [60/63] SUNRPC: Never reuse the socket port after an xs_close() Greg KH
2011-03-25 23:44 ` [61/63] fs: call security_d_instantiate in d_obtain_alias V2 Greg KH
2011-03-25 23:44 ` [62/63] dcdbas: force SMI to happen when expected Greg KH
2011-03-25 23:44 ` [63/63] ext4: skip orphan cleanup if fs has unknown ROCOMPAT features Greg KH
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20110325234512.646048952@clark.kroah.org \
--to=gregkh@suse.de \
--cc=akpm@linux-foundation.org \
--cc=alan@lxorguk.ukuu.org.uk \
--cc=jhovold@gmail.com \
--cc=linux-kernel@vger.kernel.org \
--cc=stable-review@kernel.org \
--cc=stable@kernel.org \
--cc=torvalds@linux-foundation.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®