Patch appended, tested with an OV511 on an Intel PIIX4
drivers/usb/core/hub.c: new USB device 00:07.2-1, assigned address 2
------------[ cut here ]------------
kernel BUG at mm/slab.c:1453!
invalid operand: 0000
CPU: 0
EIP: 0060:[<c014550a>] Not tainted
EFLAGS: 00010093
eax: 00000000 ebx: 00000048 ecx: c7e00000 edx: c7e00190
esi: c7e00148 edi: c7e0014c ebp: c7fff1d0 esp: c7f09e6c
ds: 0068 es: 0068 ss: 0068
Process khubd (pid: 5, threadinfo=c7f08000 task=c7fa7940)
Stack: c7efbc00 c7fff1d0 c7e0014c 00000292 c01448b1 c7fff1d0 c7e0014c c1494195
c7e00170 c15a8768 c7e0014c c031c9c2 c7e0014c c149418e c7e00194 00000040
00000000 c1494155 00000000 c1494155 c031cda3 c1565ed4 c1494155 00000040
Call Trace: [<c01448b1>] [<c031c9c2>] [<c031cda3>] [<c031d221>] [<c0316ebf>]
[<c0318f3f>] [<c0319350>] [<c0319445>] [<c011eae0>] [<c0319410>] [<c0108df5>]
Code: 0f 0b ad 05 21 26 46 c0 8b 5d 38 8b 79 0c 89 f0 29 f8 31 d2
<1>Unable to handle kernel paging request at virtual address 5a5a5a5c
printing eip:
c0322781
*pde = 00000000
Oops: 0000
CPU: 0
EIP: 0060:[<c0322781>] Not tainted
EFLAGS: 00010287
eax: 00000002 ebx: 00000014 ecx: c7b74000 edx: c7b56182
esi: c7b56182 edi: 5a5a5a5a ebp: 00000002 esp: c7b75e08
ds: 0068 es: 0068 ss: 0068
Process grep (pid: 58, threadinfo=c7b74000 task=c15e7980)
Stack: 00000001 00000001 000000ff c048d578 00000000 00000000 00000001 c1565ed4
c1565ed4 00000014 c15a875c 00000001 c7b57f00 c0322a5e 00000002 c7b56182
c7b57f00 5a5a5a5a c1565ed4 00000002 00000002 c7b57f00 c0322b5a 00000002
Call Trace: [<c0322a5e>] [<c0322b5a>] [<c0322ddd>] [<c0322ed4>] [<c0322fdc>]
[<c032317f>] [<c015730c>] [<c015751a>] [<c010b207>]
Code: 8a 47 02 31 d2 88 44 24 17 83 e0 80 88 c2 c6 44 24 23 49 85
This is only the first oops decoded, the second one is a fallout.
>>EIP; c014550a <cache_free_debugcheck+8a/190> <=====
>>ecx; c7e00000 <_end+7811944/302159a4>
>>edx; c7e00190 <_end+7811ad4/302159a4>
>>esi; c7e00148 <_end+7811a8c/302159a4>
>>edi; c7e0014c <_end+7811a90/302159a4>
>>ebp; c7fff1d0 <_end+7a10b14/302159a4>
>>esp; c7f09e6c <_end+791b7b0/302159a4>
Trace; c01448b1 <kfree+61/e0>
Trace; c031c9c2 <usb_parse_interface+b2/320>
Trace; c031cda3 <usb_parse_configuration+173/230>
Trace; c031d221 <usb_get_configuration+181/260>
Trace; c0316ebf <usb_new_device+1cf/3e0>
Trace; c0318f3f <usb_hub_port_connect_change+17f/280>
Trace; c0319350 <usb_hub_events+310/3d0>
Trace; c0319445 <usb_hub_thread+35/e0>
Trace; c011eae0 <default_wake_function+0/40>
Trace; c0319410 <usb_hub_thread+0/e0>
Trace; c0108df5 <kernel_thread_helper+5/10>
Code; c014550a <cache_free_debugcheck+8a/190>
00000000 <_EIP>:
Code; c014550a <cache_free_debugcheck+8a/190> <=====
0: 0f 0b ud2a <=====
Code; c014550c <cache_free_debugcheck+8c/190>
2: ad lods %ds:(%esi),%eax
Code; c014550d <cache_free_debugcheck+8d/190>
3: 05 21 26 46 c0 add $0xc0462621,%eax
Code; c0145512 <cache_free_debugcheck+92/190>
8: 8b 5d 38 mov 0x38(%ebp),%ebx
Code; c0145515 <cache_free_debugcheck+95/190>
b: 8b 79 0c mov 0xc(%ecx),%edi
Code; c0145518 <cache_free_debugcheck+98/190>
e: 89 f0 mov %esi,%eax
Code; c014551a <cache_free_debugcheck+9a/190>
10: 29 f8 sub %edi,%eax
Code; c014551c <cache_free_debugcheck+9c/190>
12: 31 d2 xor %edx,%edx
Index: linux-2.5.48/drivers/usb/core/config.c
===================================================================
RCS file: /build/cvsroot/linux-2.5.48/drivers/usb/core/config.c,v
retrieving revision 1.1.1.1
diff -u -r1.1.1.1 config.c
--- linux-2.5.48/drivers/usb/core/config.c 18 Nov 2002 05:11:02 -0000 1.1.1.1
+++ linux-2.5.48/drivers/usb/core/config.c 18 Nov 2002 07:09:57 -0000
@@ -109,7 +109,8 @@
interface->num_altsetting = 0;
interface->max_altsetting = USB_ALTSETTINGALLOC;
- interface->altsetting = kmalloc(sizeof(struct usb_interface_descriptor) * interface->max_altsetting, GFP_KERNEL);
+ interface->altsetting = kmalloc(sizeof(*interface->altsetting) * interface->max_altsetting,
+ GFP_KERNEL);
if (!interface->altsetting) {
err("couldn't kmalloc interface->altsetting");
@@ -118,29 +119,27 @@
while (size > 0) {
struct usb_interface_descriptor *d;
-
+
if (interface->num_altsetting >= interface->max_altsetting) {
- void *ptr;
+ struct usb_host_interface *ptr;
int oldmas;
oldmas = interface->max_altsetting;
interface->max_altsetting += USB_ALTSETTINGALLOC;
if (interface->max_altsetting > USB_MAXALTSETTING) {
- warn("too many alternate settings (max %d)",
- USB_MAXALTSETTING);
+ warn("too many alternate settings (incr %d max %d)\n",
+ USB_ALTSETTINGALLOC, USB_MAXALTSETTING);
return -1;
}
- ptr = interface->altsetting;
- interface->altsetting = kmalloc(sizeof(struct usb_interface_descriptor) * interface->max_altsetting, GFP_KERNEL);
- if (!interface->altsetting) {
+ ptr = kmalloc(sizeof(*ptr) * interface->max_altsetting, GFP_KERNEL);
+ if (ptr == NULL) {
err("couldn't kmalloc interface->altsetting");
- interface->altsetting = ptr;
return -1;
}
- memcpy(interface->altsetting, ptr, sizeof(struct usb_interface_descriptor) * oldmas);
-
- kfree(ptr);
+ memcpy(ptr, interface->altsetting, sizeof(*interface->altsetting) * oldmas);
+ kfree(interface->altsetting);
+ interface->altsetting = ptr;
}
ifp = interface->altsetting + interface->num_altsetting;
--
function.linuxpower.ca
I got larted on the grounds that i write lame changelogs so here we go
again :}
parse_interface allocates the incorrect storage size for additional
altsettings (new buffer) leading to a BUG being triggered in
mm/slab.c:1453 when we do the memcpy from the old buffer to the new
buffer (writing beyond new buffer).
Zwane
--
function.linuxpower.ca
On Mon, Nov 18, 2002 at 02:17:37AM -0500, Zwane Mwaikambo wrote:
> Patch appended, tested with an OV511 on an Intel PIIX4
Thanks for finding this. It happened when the structures changed a bit
a few kernels ago. I've added this to my trees and will send it to
Linus soon.
greg k-h