diff for duplicates of <20180717114104.irgdb5rmg2qxclgp@debian> diff --git a/a/1.txt b/N1/1.txt index 6540a3b..037f6cc 100644 --- a/a/1.txt +++ b/N1/1.txt @@ -38,7 +38,124 @@ So, now waiting for you to analyze what is going on and suggest a proper fix. Thanks in advance. - --- +--- Regards Sudip +[ 236.814156] ================================================================== +[ 236.814187] BUG: KASAN: use-after-free in xhci_trb_virt_to_dma+0x2e/0x74 [xhci_hcd] +[ 236.814193] Read of size 8 at addr ffff8800789329c8 by task weston/138 + +[ 236.814203] CPU: 0 PID: 138 Comm: weston Tainted: G U W O 4.14.47-20180606+ #7 +[ 236.814206] Hardware name: xxx, BIOS 2017.01-00087-g43e04de 08/30/2017 +[ 236.814209] Call Trace: +[ 236.814214] <IRQ> +[ 236.814226] dump_stack+0x46/0x59 +[ 236.814238] print_address_description+0x6b/0x23b +[ 236.814255] ? xhci_trb_virt_to_dma+0x2e/0x74 [xhci_hcd] +[ 236.814262] kasan_report+0x220/0x246 +[ 236.814278] xhci_trb_virt_to_dma+0x2e/0x74 [xhci_hcd] +[ 236.814294] trb_in_td+0x3b/0x1cd [xhci_hcd] +[ 236.814311] handle_cmd_completion+0x1181/0x2c9b [xhci_hcd] +[ 236.814329] ? xhci_queue_new_dequeue_state+0x5d9/0x5d9 [xhci_hcd] +[ 236.814337] ? drm_handle_vblank+0x4ec/0x590 +[ 236.814352] xhci_irq+0x529/0x3294 [xhci_hcd] +[ 236.814362] ? __accumulate_pelt_segments+0x24/0x33 +[ 236.814378] ? finish_td.isra.40+0x223/0x223 [xhci_hcd] +[ 236.814384] ? __accumulate_pelt_segments+0x24/0x33 +[ 236.814390] ? __accumulate_pelt_segments+0x24/0x33 +[ 236.814405] ? xhci_irq+0x3294/0x3294 [xhci_hcd] +[ 236.814412] __handle_irq_event_percpu+0x149/0x3db +[ 236.814421] handle_irq_event_percpu+0x65/0x109 +[ 236.814428] ? __handle_irq_event_percpu+0x3db/0x3db +[ 236.814436] ? ttwu_do_wakeup.isra.18+0x3a2/0x3ce +[ 236.814442] handle_irq_event+0xa8/0x10a +[ 236.814449] handle_edge_irq+0x4b2/0x538 +[ 236.814458] handle_irq+0x3e/0x45 +[ 236.814465] do_IRQ+0x5c/0x126 +[ 236.814474] common_interrupt+0x7a/0x7a +[ 236.814478] </IRQ> +[ 236.814483] RIP: 0023:0xf79d3d82 +[ 236.814486] RSP: 002b:00000000ffc588e8 EFLAGS: 00200282 ORIG_RAX: ffffffffffffffdc +[ 236.814493] RAX: 0000000000000000 RBX: 00000000f7bebd5c RCX: 0000000000000000 +[ 236.814496] RDX: 0000000008d4197c RSI: 0000000000000000 RDI: 00000000f746c020 +[ 236.814499] RBP: 00000000ffc588e8 R08: 0000000000000000 R09: 0000000000000000 +[ 236.814503] R10: 0000000000000000 R11: 0000000000200206 R12: 0000000000000000 +[ 236.814506] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 + +[ 236.814513] Allocated by task 2082: +[ 236.814521] kasan_kmalloc.part.1+0x51/0xc7 +[ 236.814526] kmem_cache_alloc_trace+0x178/0x187 +[ 236.814540] xhci_segment_alloc.isra.11+0x9d/0x3bf [xhci_hcd] +[ 236.814553] xhci_alloc_segments_for_ring+0x9e/0x176 [xhci_hcd] +[ 236.814566] xhci_ring_alloc.constprop.16+0x197/0x4ba [xhci_hcd] +[ 236.814579] xhci_endpoint_init+0x77a/0x9ba [xhci_hcd] +[ 236.814592] xhci_add_endpoint+0x3bc/0x43b [xhci_hcd] +[ 236.814615] usb_hcd_alloc_bandwidth+0x7ef/0x857 [usbcore] +[ 236.814637] usb_set_interface+0x294/0x681 [usbcore] +[ 236.814645] btusb_work+0x2e6/0x981 [btusb] +[ 236.814651] process_one_work+0x579/0x9e9 +[ 236.814656] worker_thread+0x68f/0x804 +[ 236.814662] kthread+0x31c/0x32b +[ 236.814668] ret_from_fork+0x35/0x40 + +[ 236.814672] Freed by task 1533: +[ 236.814678] kasan_slab_free+0xb3/0x15e +[ 236.814683] kfree+0x103/0x1a9 +[ 236.814696] xhci_ring_free+0x205/0x286 [xhci_hcd] +[ 236.814709] xhci_free_endpoint_ring+0x4d/0x83 [xhci_hcd] +[ 236.814722] xhci_check_bandwidth+0x57b/0x65a [xhci_hcd] +[ 236.814743] usb_hcd_alloc_bandwidth+0x665/0x857 [usbcore] +[ 236.814765] usb_set_interface+0x294/0x681 [usbcore] +[ 236.814772] btusb_work+0x664/0x981 [btusb] +[ 236.814777] process_one_work+0x579/0x9e9 +[ 236.814782] worker_thread+0x68f/0x804 +[ 236.814788] kthread+0x31c/0x32b +[ 236.814793] ret_from_fork+0x35/0x40 + +[ 236.814799] The buggy address belongs to the object at ffff8800789329c8 + which belongs to the cache kmalloc-64 of size 64 +[ 236.814804] The buggy address is located 0 bytes inside of + 64-byte region [ffff8800789329c8, ffff880078932a08) +[ 236.814806] The buggy address belongs to the page: +[ 236.814812] page:ffffea0001e24c80 count:1 mapcount:0 mapping: (null) index:0x0 compound_mapcount: 0 +[ 236.825813] flags: 0x4000000000008100(slab|head) +[ 236.830981] raw: 4000000000008100 0000000000000000 0000000000000000 0000000100130013 +[ 236.830988] raw: ffffea0000cfbaa0 ffffea00010ddf20 ffff88013b80f640 0000000000000000 +[ 236.830990] page dumped because: kasan: bad access detected + +[ 236.830993] Memory state around the buggy address: +[ 236.830999] ffff880078932880: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc +[ 236.831004] ffff880078932900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc +[ 236.831008] >ffff880078932980: fc fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb +[ 236.831011] ^ +[ 236.831015] ffff880078932a00: fb fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc +[ 236.831019] ffff880078932a80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc +[ 236.831021] ================================================================== +[ 236.831024] Disabling lock debugging due to kernel taint + +From cbbe6dc59ac90a4f2c358de56e58e254320171e0 Mon Sep 17 00:00:00 2001 +From: Sudip Mukherjee <sudipm.mukherjee@gmail.com> +Date: Tue, 10 Jul 2018 09:50:00 +0100 +Subject: [PATCH] hacky solution to mem-corruption + +Signed-off-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com> +--- + drivers/usb/core/message.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/usb/core/message.c b/drivers/usb/core/message.c +index 7cd4ec33dbf4..7fdf7a27611d 100644 +--- a/drivers/usb/core/message.c ++++ b/drivers/usb/core/message.c +@@ -1398,7 +1398,8 @@ int usb_set_interface(struct usb_device *dev, int interface, int alternate) + remove_intf_ep_devs(iface); + usb_remove_sysfs_intf_files(iface); + } +- usb_disable_interface(dev, iface, true); ++ if (!(iface->cur_altsetting && alt)) ++ usb_disable_interface(dev, iface, true); + + iface->cur_altsetting = alt; + +-- +2.11.0 diff --git a/a/2.hdr b/a/2.hdr deleted file mode 100644 index 9066514..0000000 --- a/a/2.hdr +++ /dev/null @@ -1,2 +0,0 @@ -Content-Type: text/plain; charset=us-ascii -Content-Disposition: attachment; filename=usb_kasan diff --git a/a/2.txt b/a/2.txt deleted file mode 100644 index 950c167..0000000 --- a/a/2.txt +++ /dev/null @@ -1,91 +0,0 @@ -[ 236.814156] ================================================================== -[ 236.814187] BUG: KASAN: use-after-free in xhci_trb_virt_to_dma+0x2e/0x74 [xhci_hcd] -[ 236.814193] Read of size 8 at addr ffff8800789329c8 by task weston/138 - -[ 236.814203] CPU: 0 PID: 138 Comm: weston Tainted: G U W O 4.14.47-20180606+ #7 -[ 236.814206] Hardware name: xxx, BIOS 2017.01-00087-g43e04de 08/30/2017 -[ 236.814209] Call Trace: -[ 236.814214] <IRQ> -[ 236.814226] dump_stack+0x46/0x59 -[ 236.814238] print_address_description+0x6b/0x23b -[ 236.814255] ? xhci_trb_virt_to_dma+0x2e/0x74 [xhci_hcd] -[ 236.814262] kasan_report+0x220/0x246 -[ 236.814278] xhci_trb_virt_to_dma+0x2e/0x74 [xhci_hcd] -[ 236.814294] trb_in_td+0x3b/0x1cd [xhci_hcd] -[ 236.814311] handle_cmd_completion+0x1181/0x2c9b [xhci_hcd] -[ 236.814329] ? xhci_queue_new_dequeue_state+0x5d9/0x5d9 [xhci_hcd] -[ 236.814337] ? drm_handle_vblank+0x4ec/0x590 -[ 236.814352] xhci_irq+0x529/0x3294 [xhci_hcd] -[ 236.814362] ? __accumulate_pelt_segments+0x24/0x33 -[ 236.814378] ? finish_td.isra.40+0x223/0x223 [xhci_hcd] -[ 236.814384] ? __accumulate_pelt_segments+0x24/0x33 -[ 236.814390] ? __accumulate_pelt_segments+0x24/0x33 -[ 236.814405] ? xhci_irq+0x3294/0x3294 [xhci_hcd] -[ 236.814412] __handle_irq_event_percpu+0x149/0x3db -[ 236.814421] handle_irq_event_percpu+0x65/0x109 -[ 236.814428] ? __handle_irq_event_percpu+0x3db/0x3db -[ 236.814436] ? ttwu_do_wakeup.isra.18+0x3a2/0x3ce -[ 236.814442] handle_irq_event+0xa8/0x10a -[ 236.814449] handle_edge_irq+0x4b2/0x538 -[ 236.814458] handle_irq+0x3e/0x45 -[ 236.814465] do_IRQ+0x5c/0x126 -[ 236.814474] common_interrupt+0x7a/0x7a -[ 236.814478] </IRQ> -[ 236.814483] RIP: 0023:0xf79d3d82 -[ 236.814486] RSP: 002b:00000000ffc588e8 EFLAGS: 00200282 ORIG_RAX: ffffffffffffffdc -[ 236.814493] RAX: 0000000000000000 RBX: 00000000f7bebd5c RCX: 0000000000000000 -[ 236.814496] RDX: 0000000008d4197c RSI: 0000000000000000 RDI: 00000000f746c020 -[ 236.814499] RBP: 00000000ffc588e8 R08: 0000000000000000 R09: 0000000000000000 -[ 236.814503] R10: 0000000000000000 R11: 0000000000200206 R12: 0000000000000000 -[ 236.814506] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 - -[ 236.814513] Allocated by task 2082: -[ 236.814521] kasan_kmalloc.part.1+0x51/0xc7 -[ 236.814526] kmem_cache_alloc_trace+0x178/0x187 -[ 236.814540] xhci_segment_alloc.isra.11+0x9d/0x3bf [xhci_hcd] -[ 236.814553] xhci_alloc_segments_for_ring+0x9e/0x176 [xhci_hcd] -[ 236.814566] xhci_ring_alloc.constprop.16+0x197/0x4ba [xhci_hcd] -[ 236.814579] xhci_endpoint_init+0x77a/0x9ba [xhci_hcd] -[ 236.814592] xhci_add_endpoint+0x3bc/0x43b [xhci_hcd] -[ 236.814615] usb_hcd_alloc_bandwidth+0x7ef/0x857 [usbcore] -[ 236.814637] usb_set_interface+0x294/0x681 [usbcore] -[ 236.814645] btusb_work+0x2e6/0x981 [btusb] -[ 236.814651] process_one_work+0x579/0x9e9 -[ 236.814656] worker_thread+0x68f/0x804 -[ 236.814662] kthread+0x31c/0x32b -[ 236.814668] ret_from_fork+0x35/0x40 - -[ 236.814672] Freed by task 1533: -[ 236.814678] kasan_slab_free+0xb3/0x15e -[ 236.814683] kfree+0x103/0x1a9 -[ 236.814696] xhci_ring_free+0x205/0x286 [xhci_hcd] -[ 236.814709] xhci_free_endpoint_ring+0x4d/0x83 [xhci_hcd] -[ 236.814722] xhci_check_bandwidth+0x57b/0x65a [xhci_hcd] -[ 236.814743] usb_hcd_alloc_bandwidth+0x665/0x857 [usbcore] -[ 236.814765] usb_set_interface+0x294/0x681 [usbcore] -[ 236.814772] btusb_work+0x664/0x981 [btusb] -[ 236.814777] process_one_work+0x579/0x9e9 -[ 236.814782] worker_thread+0x68f/0x804 -[ 236.814788] kthread+0x31c/0x32b -[ 236.814793] ret_from_fork+0x35/0x40 - -[ 236.814799] The buggy address belongs to the object at ffff8800789329c8 - which belongs to the cache kmalloc-64 of size 64 -[ 236.814804] The buggy address is located 0 bytes inside of - 64-byte region [ffff8800789329c8, ffff880078932a08) -[ 236.814806] The buggy address belongs to the page: -[ 236.814812] page:ffffea0001e24c80 count:1 mapcount:0 mapping: (null) index:0x0 compound_mapcount: 0 -[ 236.825813] flags: 0x4000000000008100(slab|head) -[ 236.830981] raw: 4000000000008100 0000000000000000 0000000000000000 0000000100130013 -[ 236.830988] raw: ffffea0000cfbaa0 ffffea00010ddf20 ffff88013b80f640 0000000000000000 -[ 236.830990] page dumped because: kasan: bad access detected - -[ 236.830993] Memory state around the buggy address: -[ 236.830999] ffff880078932880: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc -[ 236.831004] ffff880078932900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc -[ 236.831008] >ffff880078932980: fc fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb -[ 236.831011] ^ -[ 236.831015] ffff880078932a00: fb fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc -[ 236.831019] ffff880078932a80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc -[ 236.831021] ================================================================== -[ 236.831024] Disabling lock debugging due to kernel taint diff --git a/a/3.hdr b/a/3.hdr deleted file mode 100644 index 26d9577..0000000 --- a/a/3.hdr +++ /dev/null @@ -1,2 +0,0 @@ -Content-Type: text/x-diff; charset=us-ascii -Content-Disposition: attachment; filename="0001-test.patch" diff --git a/a/3.txt b/a/3.txt deleted file mode 100644 index 1fcec0a..0000000 --- a/a/3.txt +++ /dev/null @@ -1,26 +0,0 @@ ->From cbbe6dc59ac90a4f2c358de56e58e254320171e0 Mon Sep 17 00:00:00 2001 -From: Sudip Mukherjee <sudipm.mukherjee-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org> -Date: Tue, 10 Jul 2018 09:50:00 +0100 -Subject: [PATCH] hacky solution to mem-corruption - -Signed-off-by: Sudip Mukherjee <sudipm.mukherjee-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org> ---- - drivers/usb/core/message.c | 3 ++- - 1 file changed, 2 insertions(+), 1 deletion(-) - -diff --git a/drivers/usb/core/message.c b/drivers/usb/core/message.c -index 7cd4ec33dbf4..7fdf7a27611d 100644 ---- a/drivers/usb/core/message.c -+++ b/drivers/usb/core/message.c -@@ -1398,7 +1398,8 @@ int usb_set_interface(struct usb_device *dev, int interface, int alternate) - remove_intf_ep_devs(iface); - usb_remove_sysfs_intf_files(iface); - } -- usb_disable_interface(dev, iface, true); -+ if (!(iface->cur_altsetting && alt)) -+ usb_disable_interface(dev, iface, true); - - iface->cur_altsetting = alt; - --- -2.11.0 diff --git a/a/4.hdr b/a/4.hdr deleted file mode 100644 index 4b86001..0000000 --- a/a/4.hdr +++ /dev/null @@ -1,4 +0,0 @@ -Content-Type: text/plain; charset="us-ascii" -MIME-Version: 1.0 -Content-Transfer-Encoding: 7bit -Content-Disposition: inline diff --git a/a/4.txt b/a/4.txt deleted file mode 100644 index 8b13789..0000000 --- a/a/4.txt +++ /dev/null @@ -1 +0,0 @@ - diff --git a/a/content_digest b/N1/content_digest index f17c890..15f5559 100644 --- a/a/content_digest +++ b/N1/content_digest @@ -1,25 +1,16 @@ - "ref\006226ecb-baad-cc36-e9e3-797dabb0aa5e@linux.intel.com\0" - "ref\042ec4ab07d96b4302b875ac9c5eb76675bf85690.camel@linux.intel.com\0" - "ref\020180606164524.n4vb7xre6rykzxih@debian\0" - "ref\02e8829c2-850d-6bca-5f0c-58a809dc9499@linux.intel.com\0" - "ref\020180621005332.5uy74tkjoel6w4xy@debian\0" - "ref\02b4fe87a-3706-0aa8-2b61-a9c1d1352a7a@linux.intel.com\0" - "ref\020180625161500.dbyxd4b434jh5jhj@debian\0" - "ref\020180627115948.ww534mkoovkt3uwb@debian\0" - "ref\04b269009-7593-a41f-9f0f-203ee174b52e@linux.intel.com\0" - "ref\020180630210704.vzkt2poh5qr3hpff@debian\0" - "From\0Sudip Mukherjee <sudipm.mukherjee-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org>\0" - "Subject\0Re: usb HC busted?\0" + "From\0Sudip Mukherjee <sudipm.mukherjee@gmail.com>\0" + "Subject\0usb HC busted?\0" "Date\0Tue, 17 Jul 2018 12:41:04 +0100\0" - "To\0Mathias Nyman <mathias.nyman-VuQAYsv1563Yd54FQh9/CA@public.gmane.org>\0" - "Cc\0Mathias Nyman <mathias.nyman-ral2JQCrhuEAvxtiuMwx3w@public.gmane.org>" - linux-usb-u79uwXL29TY76Z2rM5mHXA@public.gmane.org - iommu-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org - lukaszx.szulc-ral2JQCrhuEAvxtiuMwx3w@public.gmane.org - Andy Shevchenko <andy.shevchenko-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org> - Andy Shevchenko <andriy.shevchenko-VuQAYsv1563Yd54FQh9/CA@public.gmane.org> - " Christoph Hellwig <hch-jcswGhMUV9g@public.gmane.org>\0" - "\01:1\0" + "To\0Mathias Nyman <mathias.nyman@linux.intel.com>\0" + "Cc\0Andy Shevchenko <andriy.shevchenko@linux.intel.com>" + Andy Shevchenko <andy.shevchenko@gmail.com> + Mathias Nyman <mathias.nyman@intel.com> + linux-usb@vger.kernel.org + lukaszx.szulc@intel.com + Christoph Hellwig <hch@lst.de> + Marek Szyprowski <m.szyprowski@samsung.com> + " iommu@lists.linux-foundation.org\0" + "\00:1\0" "b\0" "Hi Mathias,\n" "\n" @@ -61,13 +52,9 @@ "fix.\n" "\n" "Thanks in advance.\n" - "\n" - "--\n" + "---\n" "Regards\n" - Sudip - "\01:2\0" - "fn\0usb_kasan\0" - "b\0" + "Sudip\n" "[ 236.814156] ==================================================================\n" "[ 236.814187] BUG: KASAN: use-after-free in xhci_trb_virt_to_dma+0x2e/0x74 [xhci_hcd]\n" "[ 236.814193] Read of size 8 at addr ffff8800789329c8 by task weston/138\n" @@ -158,16 +145,14 @@ "[ 236.831015] ffff880078932a00: fb fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc\n" "[ 236.831019] ffff880078932a80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc\n" "[ 236.831021] ==================================================================\n" - [ 236.831024] Disabling lock debugging due to kernel taint - "\01:3\0" - "fn\00001-test.patch\0" - "b\0" - ">From cbbe6dc59ac90a4f2c358de56e58e254320171e0 Mon Sep 17 00:00:00 2001\n" - "From: Sudip Mukherjee <sudipm.mukherjee-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org>\n" + "[ 236.831024] Disabling lock debugging due to kernel taint\n" + "\n" + "From cbbe6dc59ac90a4f2c358de56e58e254320171e0 Mon Sep 17 00:00:00 2001\n" + "From: Sudip Mukherjee <sudipm.mukherjee@gmail.com>\n" "Date: Tue, 10 Jul 2018 09:50:00 +0100\n" "Subject: [PATCH] hacky solution to mem-corruption\n" "\n" - "Signed-off-by: Sudip Mukherjee <sudipm.mukherjee-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org>\n" + "Signed-off-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com>\n" "---\n" " drivers/usb/core/message.c | 3 ++-\n" " 1 file changed, 2 insertions(+), 1 deletion(-)\n" @@ -188,7 +173,5 @@ " \n" "-- \n" 2.11.0 - "\01:4\0" - "b\0" -be36211cf5530062fa62f6d002bd47ada1da6fcfffe2bac97de28288cf758262 +45ed86bb97144a678ce6ffdee45191adb4410731f166b51b1293ccc63c824ddd
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.