[Bug 1181104] New: Unplugging TeVII DVB-S2 USB adapter crashes kernel - openSUSE Kernel Bugs - openSUSE Mailing Lists

newer
[Bug 1181133] New: Logitech...

[Bug 1181104] New: Unplugging TeVII DVB-S2 USB adapter crashes kernel

older
[Bug 1181018] floppy broken in...

bugzilla_noreply＠suse.com

19 Jan 2021 19 Jan '21

10:41

http://bugzilla.opensuse.org/show_bug.cgi?id=1181104 Bug ID: 1181104 Summary: Unplugging TeVII DVB-S2 USB adapter crashes kernel Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Kernel Assignee: kernel-bugs@opensuse.org Reporter: seife@novell.slipkontur.de QA Contact: qa-bugs@suse.de CC: oneukum@suse.com Found By: --- Blocker: --- Created attachment 845254 --> http://bugzilla.opensuse.org/attachment.cgi?id=845254&action=edit dmesg after finally crashing at third unplug cycle Recently I plugged a seldom-used TeVii S660 DVB-S2 Adapter into my laptop and after undocking found a kernel oops. I tracked this down to "Last working Kernel 4.17", even tried to bisect it but was not successful (ended up in an obviously unrelated commit). This is probably some kind of race condition, since reproducing in a KVM VM (with usb passthroug) sometimes only crashes after a few tries. On real hardware it crashes pretty reliably for me, this is why I prefer to test this in a VM :-) See attached dmesg of the oopsed kenrel. I can try whatever you deem useful :-) -- You are receiving this mail because: You are the assignee for the bug.

Attachments:

attachment.htm (text/html — 3.1 KB)

Reply

Sign in to reply online Use email software

Show replies by date

bugzilla_noreply＠suse.com

19 Jan 19 Jan

12:29

New subject: [Bug 1181104] Unplugging TeVII DVB-S2 USB adapter crashes kernel

http://bugzilla.opensuse.org/show_bug.cgi?id=1181104 http://bugzilla.opensuse.org/show_bug.cgi?id=1181104#c2 --- Comment #2 from Stefan Seyfried --- I am pretty sure it is an use-after-free or an invalid d->desc pointer in dvb_usb_device_exit() in drivers/media/usb/dvb-usb/dvb-usb-init.c sometimes it does not immediately crash but shows garbage like dvb-usb: �� successfully deinitialized and disconnected. -- You are receiving this mail because: You are the assignee for the bug.

Reply

Sign in to reply online Use email software

bugzilla_noreply＠suse.com

12:47

New subject: [Bug 1181104] Unplugging TeVII DVB-S2 USB adapter crashes kernel

http://bugzilla.opensuse.org/show_bug.cgi?id=1181104 http://bugzilla.opensuse.org/show_bug.cgi?id=1181104#c3 --- Comment #3 from Stefan Seyfried --- One more thing: when (trying to...) bisecting this, at the oldest occurence around 4.18rc... I only got (sometimes) "(null) successfully deinitialized and disconnected" (which I then marked as "bad". The NULL pointer dereference (which is pretty consistently happening today) is probably from uninitialized memory, because before it was e.g. usb 1-1: USB disconnect, device number 3 general protection fault, probably for non-canonical address 0x33303030623a7475: 0000 [#1] SMP NOPTI CPU: 0 PID: 1927 Comm: kworker/0:2 Not tainted 5.10.7-1-default #1 openSUSE Tumbleweed Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 Workqueue: usb_hub_wq hub_event [usbcore] RIP: 0010:strscpy+0x6a/0x150 Code: 48 bb ff fe fe fe fe fe fe fe eb 1e 48 89 0c 07 4c 89 da 48 83 c0 08 4c 89 d1 48 29 c2 48 29 c1 48 83 fa 07 0f 86 87 00 00 00 <> RSP: 0018:ffff9983814efbd0 EFLAGS: 00010246 RAX: 0000000000000000 RBX: fefefefefefefeff RCX: 0000000000000081 RDX: 0000000000000028 RSI: 8080808080808080 RDI: ffff9983814efbe0 RBP: ffff8c9f82804000 R08: 33303030623a7475 R09: 0000000000000000 R10: 0000000000000028 R11: 0000000000000028 R12: ffff9983814efbe0 R13: ffff8c9fb23dd800 R14: ffff8c9fb23dd830 R15: 0000000000000002 FS: 0000000000000000(0000) GS:ffff8c9fbec00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fc37783f300 CR3: 0000000018c96000 CR4: 00000000000006f0 Call Trace: dvb_usb_device_exit+0x52/0xa0 [dvb_usb] R08 obviously contains ASCII text in this case ;-) -- You are receiving this mail because: You are the assignee for the bug.

Reply

Sign in to reply online Use email software

bugzilla_noreply＠suse.com

13:48

New subject: [Bug 1181104] Unplugging TeVII DVB-S2 USB adapter crashes kernel

http://bugzilla.opensuse.org/show_bug.cgi?id=1181104 http://bugzilla.opensuse.org/show_bug.cgi?id=1181104#c4 --- Comment #4 from Takashi Iwai --- It's dw2102 driver, right? I took at look at the code, and it's very obvious that it leads to UAF. The driver allocates some properties via kmemdup() and modifies some fields, pass the object, and release the object at the probe, while dvb_usb_device still refers to it. The bug must have been introduced by the commit 299c7007e93645067e1d2743f4e50156de78c4ff media: dw2102: Fix memleak on sequence of probes around 4.19 kernel. Maybe the commit was backported to the stable 4.18.x, too. Below is the tentative fix. Please check it. -- You are receiving this mail because: You are the assignee for the bug.

Reply

Sign in to reply online Use email software

bugzilla_noreply＠suse.com

13:49

New subject: [Bug 1181104] Unplugging TeVII DVB-S2 USB adapter crashes kernel

http://bugzilla.opensuse.org/show_bug.cgi?id=1181104 http://bugzilla.opensuse.org/show_bug.cgi?id=1181104#c5 --- Comment #5 from Takashi Iwai --- Created attachment 845267 --> http://bugzilla.opensuse.org/attachment.cgi?id=845267&action=edit Tentative fix for UAF in dw2102 driver -- You are receiving this mail because: You are the assignee for the bug.

Reply

Sign in to reply online Use email software

bugzilla_noreply＠suse.com

14:06

New subject: [Bug 1181104] Unplugging TeVII DVB-S2 USB adapter crashes kernel

http://bugzilla.opensuse.org/show_bug.cgi?id=1181104 http://bugzilla.opensuse.org/show_bug.cgi?id=1181104#c6 --- Comment #6 from Stefan Seyfried --- Hi Takashi, I could not get the kernel to crash with 4.18, but I did (sometimes, this is why I suspected a race...) get "(null)" as name in the deallocation message. I assumed that this was the "original" bug which later (newer gcc, 4.18 did not even build with gcc9 for me, so used gcc7, different optimization, whatever...) turned into a crash. And this is probably why it was impossible (for me) to bisect, apart from "it sometimes fails only once in ten tries" being hard to make a "good/bad" decision :-) I'm building the patched driver right now, will be back with test results, soon. -- You are receiving this mail because: You are the assignee for the bug.

Reply

Sign in to reply online Use email software

bugzilla_noreply＠suse.com

14:40

New subject: [Bug 1181104] Unplugging TeVII DVB-S2 USB adapter crashes kernel

http://bugzilla.opensuse.org/show_bug.cgi?id=1181104 http://bugzilla.opensuse.org/show_bug.cgi?id=1181104#c7 --- Comment #7 from Stefan Seyfried --- The patched driver (patched upstream kernel v5.11-rc3-332-g0da0a8a0a0e1, because that one was already in ccache, to speed things up...) survived 100 plug-unplug cycles without any issues, so this looks like a proper fix. Obviously the original memleak-"fix" was never tested in real life ;-) But yes, the DVB setups often are some kind of "embedded box" where you never update unless you absolutely have to. Or people have the hardware lying around, but no longer use it (which is the case for me, I have two different USB DVB boxes and just always used the other one, until now, when I could not find it :-) And they are just used for debugging stuff on x86 hardware which is hard to debug on embedded sh4 boxes ;-) Anyway. Thanks for the quick fix. -- You are receiving this mail because: You are the assignee for the bug.

Reply

Sign in to reply online Use email software

bugzilla_noreply＠suse.com

18:44

New subject: [Bug 1181104] Unplugging TeVII DVB-S2 USB adapter crashes kernel

http://bugzilla.opensuse.org/show_bug.cgi?id=1181104 http://bugzilla.opensuse.org/show_bug.cgi?id=1181104#c11 Stefan Seyfried changed: What |Removed |Added ---------------------------------------------------------------------------- Flags|needinfo?(seife@novell.slip | |kontur.de) | --- Comment #11 from Stefan Seyfried --- The second patch in addition to the first also survived the "100 times plug/unplug" test. I then tested only the second patch with the dw2102 reverted and it also survived the plug/unplug test. For the "Reported-and-tested-by:", please use "Stefan Seyfried " for consistency. Thanks for the quick fixes. I'll promise to more often plug/unplug all avialable hardware in the future to not let things break like this for 2+ years again ;-) -- You are receiving this mail because: You are the assignee for the bug.

Reply

Sign in to reply online Use email software

1194

Age (days ago)

1194

Last active (days ago)

Download

7 comments

1 participants

tags

participants (1)

bugzilla_noreply＠suse.com