Re: Null Pointer Dereference in mceusb

Re: Null Pointer Dereference in mceusb

[Johan Hovold]

[ +CC: media list ]

On Wed, May 31, 2017 at 08:25:42PM +0200, Sebastian wrote:
> Hi list,
> 
> as kindly suggested by gregkh
> (https://bugzilla.kernel.org/show_bug.cgi?id=195943), I am now sending
> the mail to this mailing list.
> I have set up the latest Ubuntu 17.04 server within a qemu/kvm virtual
> machine and experienced the following bug in the mce_usb driver:

What is the lsusb -v output for your device? And have you successfully
used this device with this driver before?
 
> [ 2873.734554] usb usb1-port1: unable to enumerate USB device
> [ 2906.929123] BUG: unable to handle kernel NULL pointer dereference
> at 0000000000000003
> [ 2906.931178] IP: mce_request_packet+0x66/0x210 [mceusb]
> [ 2906.932512] PGD 0
> [ 2906.932514]
> [ 2906.933561] Oops: 0000 [#1] SMP
> [ 2906.934382] Modules linked in: kaweth zd1211rw ir_rc6_decoder
> ir_lirc_codec lirc_dev rc_rc6_mce mceusb rc_core ftdi_sio usbserial
> usb_storage usbhid hid at
> 76c50x_usb mac80211 cfg80211 ppdev joydev input_leds i2c_piix4
> parport_pc parport pvpanic mac_hid serio_raw ib_iser rdma_cm iw_cm
> ib_cm ib_core configfs iscsi
> _tcp libiscsi_tcp libiscsi scsi_transport_iscsi ip_tables x_tables
> autofs4 btrfs raid10 raid456 async_raid6_recov async_memcpy async_pq
> async_xor async_tx xor
>  raid6_pq libcrc32c raid1 raid0 multipath linear cirrus ttm
> drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops psmouse
> drm e1000 floppy pata_acpi
> [ 2906.950961] CPU: 0 PID: 3 Comm: kworker/0:0 Not tainted
> 4.10.0-19-generic #21-Ubuntu

Can you reproduce this with a more recent mainline kernel (e.g.
4.11.3)?

This looks like something which could happen if the device is lacking an
OUT endpoint, and a sanity check to catch that recently went in (and was
backported to the non-EOL stable trees).

Thanks,
Johan

Re: Null Pointer Dereference in mceusb

[Sebastian]

Sorry for the long delay, Johan.

2017-06-01 9:20 GMT+02:00 Johan Hovold <johan@kernel.org>:
> [ +CC: media list ]
>
> On Wed, May 31, 2017 at 08:25:42PM +0200, Sebastian wrote:
>
> What is the lsusb -v output for your device? And have you successfully
> used this device with this driver before?
>

No, the device wasn't successfully used before that- it crashed every time,
so I threw away the usb receiver. This is also the reason why I cannot give
you the lsusb output. But I can give you the VID:PID -> 03ee:2501 if that
is of any help?

>
> Can you reproduce this with a more recent mainline kernel (e.g.
> 4.11.3)?

Unfortunately no :(

>
> This looks like something which could happen if the device is lacking an
> OUT endpoint, and a sanity check to catch that recently went in (and was
> backported to the non-EOL stable trees).

I could buy the same device again and try?

Thanks for your help,
Sebastian

Re: Null Pointer Dereference in mceusb

[Johan Hovold]

On Thu, Jun 29, 2017 at 07:41:24PM +0200, Sebastian wrote:
> Sorry for the long delay, Johan.
> 
> 2017-06-01 9:20 GMT+02:00 Johan Hovold <johan@kernel.org>:
> > [ +CC: media list ]
> >
> > On Wed, May 31, 2017 at 08:25:42PM +0200, Sebastian wrote:
> >
> > What is the lsusb -v output for your device? And have you successfully
> > used this device with this driver before?
> >
> 
> No, the device wasn't successfully used before that- it crashed every time,
> so I threw away the usb receiver. This is also the reason why I cannot give
> you the lsusb output. But I can give you the VID:PID -> 03ee:2501 if that
> is of any help?

Ok, so it's not necessarily a (recent) regression at least. I can't seem
to find anyone else posting lsusb -v output for that device
unfortunately.

> > Can you reproduce this with a more recent mainline kernel (e.g.
> > 4.11.3)?
> 
> Unfortunately no :(
> 
> >
> > This looks like something which could happen if the device is lacking an
> > OUT endpoint, and a sanity check to catch that recently went in (and was
> > backported to the non-EOL stable trees).
> 
> I could buy the same device again and try?

If you're willing to that, that'd very helpful; either to verify that
the crash is already fixed (as mentioned above), or to allow us to track
down the separate issue.

Thanks,
Johan

Re: Null Pointer Dereference in mceusb

[Lars Melin]

On 2017-07-03 15:10, Johan Hovold wrote:
> On Thu, Jun 29, 2017 at 07:41:24PM +0200, Sebastian wrote:
>> Sorry for the long delay, Johan.
>>
>> 2017-06-01 9:20 GMT+02:00 Johan Hovold <johan@kernel.org>:
>>> [ +CC: media list ]
>>>
>>> On Wed, May 31, 2017 at 08:25:42PM +0200, Sebastian wrote:
>>>
>>> What is the lsusb -v output for your device? And have you successfully
>>> used this device with this driver before?
>>>
>>
>> No, the device wasn't successfully used before that- it crashed every time,
>> so I threw away the usb receiver. This is also the reason why I cannot give
>> you the lsusb output. But I can give you the VID:PID -> 03ee:2501 if that
>> is of any help?
> 
> Ok, so it's not necessarily a (recent) regression at least. I can't seem
> to find anyone else posting lsusb -v output for that device
> unfortunately.
> 

Googling "03ee:2501 bDescriptorType" leads us to:
https://sourceforge.net/p/lirc/mailman/message/12852102/

/Lars

Re: Null Pointer Dereference in mceusb

[Johan Hovold]

On Mon, Jul 03, 2017 at 03:41:59PM +0700, Lars Melin wrote:
> On 2017-07-03 15:10, Johan Hovold wrote:
> > On Thu, Jun 29, 2017 at 07:41:24PM +0200, Sebastian wrote:
> >> Sorry for the long delay, Johan.
> >>
> >> 2017-06-01 9:20 GMT+02:00 Johan Hovold <johan@kernel.org>:
> >>> [ +CC: media list ]
> >>>
> >>> On Wed, May 31, 2017 at 08:25:42PM +0200, Sebastian wrote:
> >>>
> >>> What is the lsusb -v output for your device? And have you successfully
> >>> used this device with this driver before?
> >>>
> >>
> >> No, the device wasn't successfully used before that- it crashed every time,
> >> so I threw away the usb receiver. This is also the reason why I cannot give
> >> you the lsusb output. But I can give you the VID:PID -> 03ee:2501 if that
> >> is of any help?
> > 
> > Ok, so it's not necessarily a (recent) regression at least. I can't seem
> > to find anyone else posting lsusb -v output for that device
> > unfortunately.
> > 
> 
> Googling "03ee:2501 bDescriptorType" leads us to:
> https://sourceforge.net/p/lirc/mailman/message/12852102/

Thanks, Lars. Appears I didn't google hard enough.

Well that device has both a bulk IN and OUT endpoint, so if Sebastian's
device has the same descriptors, I'm left without an hypothesis as to
what would have caused the crash.

We'd need to get this verified on a recent mainline kernel (rather than
an older Ubuntu one) and then take it from there.

Thanks,
Johan