From: Greg KH <gregkh@suse.de>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: torvalds@linux-foundation.org, akpm@linux-foundation.org,
alan@lxorguk.ukuu.org.uk,
Sarah Sharp <sarah.a.sharp@linux.intel.com>,
Serge Hallyn <serge.hallyn@canonical.com>
Subject: [29/49] usbfs: Fix oops related to user namespace conversion.
Date: Tue, 10 Jan 2012 13:55:32 -0800 [thread overview]
Message-ID: <20120110215604.049729512@clark.kroah.org> (raw)
In-Reply-To: <20120110215609.GA22505@kroah.com>
3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sarah Sharp <sarah.a.sharp@linux.intel.com>
commit 1b41c8321e495337e877ca02d0b9680bc4112eff upstream.
When running the Point Grey "flycap" program for their USB 3.0 camera
(which was running as a USB 2.0 device for some reason), I trigger this
oops whenever I try to open a video stream:
Dec 15 16:48:34 puck kernel: [ 1798.715559] BUG: unable to handle kernel NULL pointer dereference at (null)
Dec 15 16:48:34 puck kernel: [ 1798.719153] IP: [<ffffffff8147841e>] free_async+0x1e/0x70
Dec 15 16:48:34 puck kernel: [ 1798.720991] PGD 6f833067 PUD 6fc56067 PMD 0
Dec 15 16:48:34 puck kernel: [ 1798.722815] Oops: 0002 [#1] SMP
Dec 15 16:48:34 puck kernel: [ 1798.724627] CPU 0
Dec 15 16:48:34 puck kernel: [ 1798.724636] Modules linked in: ecryptfs encrypted_keys sha1_generic trusted binfmt_misc sha256_generic aesni_intel cryptd aes_x86_64 aes_generic parport_pc dm_crypt ppdev joydev snd_hda_codec_hdmi snd_hda_codec_conexant arc4 iwlwifi snd_hda_intel snd_hda_codec snd_hwdep snd_pcm thinkpad_acpi mac80211 snd_seq_midi snd_rawmidi snd_seq_midi_event snd_seq snd_timer btusb uvcvideo snd_seq_device bluetooth videodev psmouse snd v4l2_compat_ioctl32 serio_raw tpm_tis cfg80211 tpm tpm_bios nvram soundcore snd_page_alloc lp parport i915 xhci_hcd ahci libahci drm_kms_helper drm sdhci_pci sdhci e1000e i2c_algo_bit video
Dec 15 16:48:34 puck kernel: [ 1798.734212]
Dec 15 16:48:34 puck kernel: [ 1798.736162] Pid: 2713, comm: FlyCap2 Not tainted 3.2.0-rc5+ #28 LENOVO 4286CTO/4286CTO
Dec 15 16:48:34 puck kernel: [ 1798.738148] RIP: 0010:[<ffffffff8147841e>] [<ffffffff8147841e>] free_async+0x1e/0x70
Dec 15 16:48:34 puck kernel: [ 1798.740134] RSP: 0018:ffff88005715fd78 EFLAGS: 00010296
Dec 15 16:48:34 puck kernel: [ 1798.742118] RAX: 00000000fffffff4 RBX: ffff88006fe8f900 RCX: 0000000000004118
Dec 15 16:48:34 puck kernel: [ 1798.744116] RDX: 0000000001000000 RSI: 0000000000016390 RDI: 0000000000000000
Dec 15 16:48:34 puck kernel: [ 1798.746087] RBP: ffff88005715fd88 R08: 0000000000000000 R09: ffffffff8146f22e
Dec 15 16:48:34 puck kernel: [ 1798.748018] R10: ffff88006e520ac0 R11: 0000000000000001 R12: ffff88005715fe28
Dec 15 16:48:34 puck kernel: [ 1798.749916] R13: ffff88005d31df00 R14: ffff88006fe8f900 R15: 00007f688c995cb8
Dec 15 16:48:34 puck kernel: [ 1798.751785] FS: 00007f68a366da40(0000) GS:ffff880100200000(0000) knlGS:0000000000000000
Dec 15 16:48:34 puck kernel: [ 1798.753659] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
Dec 15 16:48:34 puck kernel: [ 1798.755509] CR2: 0000000000000000 CR3: 00000000706bb000 CR4: 00000000000406f0
Dec 15 16:48:34 puck kernel: [ 1798.757334] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
Dec 15 16:48:34 puck kernel: [ 1798.759124] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
Dec 15 16:48:34 puck kernel: [ 1798.760871] Process FlyCap2 (pid: 2713, threadinfo ffff88005715e000, task ffff88006c675b80)
Dec 15 16:48:34 puck kernel: [ 1798.762605] Stack:
Dec 15 16:48:34 puck kernel: [ 1798.764297] ffff88005715fe28 0000000000000000 ffff88005715fe08 ffffffff81479058
Dec 15 16:48:34 puck kernel: [ 1798.766020] 0000000000000000 ffffea0000004000 ffff880000004118 0000000000000000
Dec 15 16:48:34 puck kernel: [ 1798.767750] ffff880000000001 ffff88006e520ac0 fffffff46fd81180 0000000000000000
Dec 15 16:48:34 puck kernel: [ 1798.769472] Call Trace:
Dec 15 16:48:34 puck kernel: [ 1798.771147] [<ffffffff81479058>] proc_do_submiturb+0x778/0xa00
Dec 15 16:48:34 puck kernel: [ 1798.772798] [<ffffffff8147a5fd>] usbdev_do_ioctl+0x24d/0x1200
Dec 15 16:48:34 puck kernel: [ 1798.774410] [<ffffffff8147b5de>] usbdev_ioctl+0xe/0x20
Dec 15 16:48:34 puck kernel: [ 1798.775975] [<ffffffff81189259>] do_vfs_ioctl+0x99/0x600
Dec 15 16:48:34 puck kernel: [ 1798.777534] [<ffffffff81189851>] sys_ioctl+0x91/0xa0
Dec 15 16:48:34 puck kernel: [ 1798.779088] [<ffffffff816247c2>] system_call_fastpath+0x16/0x1b
ec 15 16:48:34 puck kernel: [ 1798.780634] Code: 51 ff ff ff e9 29 ff ff ff 0f 1f 40 00 55 48 89 e5 53 48 83 ec 08 66 66 66 66 90 48 89 fb 48 8b 7f 18 e8 a6 ea c0 ff 4
8 8b 7b 20 <f0> ff 0f 0f 94 c0 84 c0 74 05 e8 d3 99 c1 ff 48 8b 43 40 48 8b
Dec 15 16:48:34 puck kernel: [ 1798.783970] RIP [<ffffffff8147841e>] free_async+0x1e/0x70
Dec 15 16:48:34 puck kernel: [ 1798.785630] RSP <ffff88005715fd78>
Dec 15 16:48:34 puck kernel: [ 1798.787274] CR2: 0000000000000000
Dec 15 16:48:34 puck kernel: [ 1798.794728] ---[ end trace 52894d3355f88d19 ]---
markup_oops.pl says the oops is in put_cred:
ffffffff81478401: 48 89 e5 mov %rsp,%rbp
ffffffff81478404: 53 push %rbx
ffffffff81478405: 48 83 ec 08 sub $0x8,%rsp
ffffffff81478409: e8 f2 c0 1a 00 callq ffffffff81624500 <mcount>
ffffffff8147840e: 48 89 fb mov %rdi,%rbx | %ebx => ffff88006fe8f900
put_pid(as->pid);
ffffffff81478411: 48 8b 7f 18 mov 0x18(%rdi),%rdi
ffffffff81478415: e8 a6 ea c0 ff callq ffffffff81086ec0 <put_pid>
put_cred(as->cred);
ffffffff8147841a: 48 8b 7b 20 mov 0x20(%rbx),%rdi | %edi => 0 %ebx = ffff88006fe8f900
*/
static inline int atomic_dec_and_test(atomic_t *v)
{
unsigned char c;
asm volatile(LOCK_PREFIX "decl %0; sete %1"
*ffffffff8147841e: f0 ff 0f lock decl (%rdi) | %edi = 0 <--- faulting instruction
ffffffff81478421: 0f 94 c0 sete %al
static inline void put_cred(const struct cred *_cred)
{
struct cred *cred = (struct cred *) _cred;
validate_creds(cred);
if (atomic_dec_and_test(&(cred)->usage))
ffffffff81478424: 84 c0 test %al,%al
ffffffff81478426: 74 05 je ffffffff8147842d <free_async+0x2d>
__put_cred(cred);
ffffffff81478428: e8 d3 99 c1 ff callq ffffffff81091e00 <__put_cred>
kfree(as->urb->transfer_buffer);
ffffffff8147842d: 48 8b 43 40 mov 0x40(%rbx),%rax
ffffffff81478431: 48 8b 78 68 mov 0x68(%rax),%rdi
ffffffff81478435: e8 a6 e1 ce ff callq ffffffff811665e0 <kfree>
kfree(as->urb->setup_packet);
ffffffff8147843a: 48 8b 43 40 mov 0x40(%rbx),%rax
ffffffff8147843e: 48 8b b8 90 00 00 00 mov 0x90(%rax),%rdi
ffffffff81478445: e8 96 e1 ce ff callq ffffffff811665e0 <kfree>
usb_free_urb(as->urb);
ffffffff8147844a: 48 8b 7b 40 mov 0x40(%rbx),%rdi
ffffffff8147844e: e8 0d 6b ff ff callq ffffffff8146ef60 <usb_free_urb>
This bug seems to have been introduced by commit
d178bc3a708f39cbfefc3fab37032d3f2511b4ec "user namespace: usb: make usb
urbs user namespace aware (v2)"
I'm not sure if this is right fix, but it does stop the oops.
Unfortunately, the Point Grey software still refuses to work, but it's a
closed source app, so I can't fix it.
Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
Acked-by: Serge Hallyn <serge.hallyn@canonical.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
drivers/usb/core/devio.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/usb/core/devio.c
+++ b/drivers/usb/core/devio.c
@@ -249,7 +249,8 @@ static struct async *alloc_async(unsigne
static void free_async(struct async *as)
{
put_pid(as->pid);
- put_cred(as->cred);
+ if (as->cred)
+ put_cred(as->cred);
kfree(as->urb->transfer_buffer);
kfree(as->urb->setup_packet);
usb_free_urb(as->urb);
next prev parent reply other threads:[~2012-01-10 23:03 UTC|newest]
Thread overview: 50+ messages / expand[flat|nested] mbox.gz Atom feed top
2012-01-10 21:56 [00/49] 3.2.1-stable review Greg KH
2012-01-10 21:55 ` [01/49] MAINTAINERS: stable: Update address Greg KH
2012-01-10 21:55 ` [02/49] Documentation: Update stable address Greg KH
2012-01-10 21:55 ` [03/49] firmware: Fix an oops on reading fw_priv->fw in sysfs loading file Greg KH
2012-01-10 21:55 ` [04/49] rt2800usb: Move ID out of unknown Greg KH
2012-01-10 21:55 ` [05/49] offb: Fix setting of the pseudo-palette for >8bpp Greg KH
2012-01-10 21:55 ` [06/49] offb: Fix bug in calculating requested vram size Greg KH
2012-01-10 21:55 ` [07/49] libertas: clean up scan thread handling Greg KH
2012-01-10 21:55 ` [08/49] bcma: support for suspend and resume Greg KH
2012-01-10 21:55 ` [09/49] wl12xx: Validate FEM index from ini file and FW Greg KH
2012-01-10 21:55 ` [10/49] wl12xx: Check buffer bound when processing nvs data Greg KH
2012-01-10 21:55 ` [11/49] wl12xx: Restore testmode ABI Greg KH
2012-01-10 21:55 ` [12/49] powerpc/time: Handle wrapping of decrementer Greg KH
2012-01-10 21:55 ` [13/49] powerpc: Fix unpaired probe_hcall_entry and probe_hcall_exit Greg KH
2012-01-10 21:55 ` [14/49] IB/qib: Fix a possible data corruption when receiving packets Greg KH
2012-01-10 21:55 ` [15/49] IB/uverbs: Protect QP multicast list Greg KH
2012-01-10 21:55 ` [16/49] iwlagn: fix TID use bug Greg KH
2012-01-10 21:55 ` [17/49] iwlagn: fix (remove) use of PAGE_SIZE Greg KH
2012-01-10 21:55 ` [18/49] perf: Fix parsing of __print_flags() in TP_printk() Greg KH
2012-01-10 21:55 ` [19/49] ore: Fix crash in case of an IO error Greg KH
2012-01-10 21:55 ` [20/49] ore: fix BUG_ON, too few sgs when reading Greg KH
2012-01-10 21:55 ` [21/49] ore: Must support none-PAGE-aligned IO Greg KH
2012-01-10 21:55 ` [22/49] ore: FIX breakage when MISC_FILESYSTEMS is not set Greg KH
2012-01-10 21:55 ` [23/49] reiserfs: Fix quota mount option parsing Greg KH
2012-01-10 21:55 ` [24/49] reiserfs: Force inode evictions before umount to avoid crash Greg KH
2012-01-10 21:55 ` [25/49] ext3: Dont warn from writepage when readonly inode is spotted after error Greg KH
2012-01-10 21:55 ` [26/49] drivers: hv: Dont OOPS when you cannot init vmbus Greg KH
2012-01-10 21:55 ` [27/49] Drivers:hv: Fix a bug in vmbus_driver_unregister() Greg KH
2012-01-10 21:55 ` [28/49] USB: update documentation for usbmon Greg KH
2012-01-10 21:55 ` Greg KH [this message]
2012-01-10 21:55 ` [30/49] atmel_serial: fix spinlock lockup in RS485 code Greg KH
2012-01-10 21:55 ` [31/49] cgroup: fix to allow mounting a hierarchy by name Greg KH
2012-01-10 21:55 ` [32/49] udf: Fix deadlock when converting file from in-ICB one to normal one Greg KH
2012-01-10 21:55 ` [33/49] drivers/usb/class/cdc-acm.c: clear dangling pointer Greg KH
2012-01-10 21:55 ` [34/49] USB: isight: fix kernel bug when loading firmware Greg KH
2012-01-10 21:55 ` [35/49] usb: usb-storage doesnt support dynamic id currently, the patch disables the feature to fix an oops Greg KH
2012-01-10 21:55 ` [36/49] USB: pxa168: Fix compilation error Greg KH
2012-01-10 21:55 ` [37/49] USB: add quirk for another camera Greg KH
2012-01-10 21:55 ` [38/49] usb: musb: fix pm_runtime mismatch Greg KH
2012-01-10 21:55 ` [39/49] USB: omninet: fix write_room Greg KH
2012-01-10 21:55 ` [40/49] usb: option: add ZD Incorporated HSPA modem Greg KH
2012-01-10 21:55 ` [41/49] USB: Add USB-ID for Multiplex RC serial adapter to cp210x.c Greg KH
2012-01-10 21:55 ` [42/49] usb: fix number of mapped SG DMA entries Greg KH
2012-01-10 21:55 ` [43/49] xhci: Properly handle COMP_2ND_BW_ERR Greg KH
2012-01-10 21:55 ` [44/49] usb: ch9: fix up MaxStreams helper Greg KH
2012-01-10 21:55 ` [45/49] igmp: Avoid zero delay when receiving odd mixture of IGMP queries Greg KH
2012-01-10 21:55 ` [46/49] asix: fix infinite loop in rx_fixup() Greg KH
2012-01-10 21:55 ` [47/49] bonding: fix error handling if slave is busy (v2) Greg KH
2012-01-10 21:55 ` [48/49] usb: cdc-acm: Fix acm_tty_hangup() vs. acm_tty_close() race Greg KH
2012-01-10 21:55 ` [49/49] xfs: fix acl count validation in xfs_acl_from_disk() Greg KH
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20120110215604.049729512@clark.kroah.org \
--to=gregkh@suse.de \
--cc=akpm@linux-foundation.org \
--cc=alan@lxorguk.ukuu.org.uk \
--cc=linux-kernel@vger.kernel.org \
--cc=sarah.a.sharp@linux.intel.com \
--cc=serge.hallyn@canonical.com \
--cc=stable@vger.kernel.org \
--cc=torvalds@linux-foundation.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®