From: David Mosberger <davidm@napali.hpl.hp.com>
To: David Brownell <david-b@pacbell.net>
Cc: davidm@hpl.hp.com, Grant Grundler <iod00d@hp.com>,
Greg KH <greg@kroah.com>,
vojtech@suse.cz, linux-usb-devel@lists.sourceforge.net,
linux-kernel@vger.kernel.org, linux-ia64@vger.kernel.org,
pochini@shiny.it
Subject: Re: [linux-usb-devel] Re: serious 2.6 bug in USB subsystem?
Date: Wed, 10 Mar 2004 10:04:38 -0800 [thread overview]
Message-ID: <16463.22710.230252.777998@napali.hpl.hp.com> (raw)
In-Reply-To: <404F40C2.3080003@pacbell.net>
>>>>> On Wed, 10 Mar 2004 08:22:26 -0800, David Brownell <david-b@pacbell.net> said:
David.B> It won't add new BUG_ON calls (WARN at worst)
I put them there mostly as assertions. What I'd really want there is
a DEBUG_BUG_ON, which is more like assert() in user-land (i.e.,
production code would drop the checks). WARN_ON() would be fine, too.
>> The current OHCI relies on the internals of the dma_pool()
>> implementation. If the implementation changed to, say, modify
>> the memory that is free or, heaven forbid, return the memory to
>> the kernel, you'd get _extremely_ difficult to track down race
>> conditions.
David.B> It'd be good if you said _how_ you think it relies on such
David.B> internals.
I thought I did. Suppose somebody changed the dma_pool code such that
it would overwrite freed memory with an 0xf00000000000000 pattern. If
the HC can still hold a reference to a freed ED (it can without my
patch), the HC could see this kind of ED:
hw=(info=00000000 tailp=f0000000 headp=00000000 nextED=f0000000)
If so, the HC would go ahead and try to interpret the memory at
address 0 as a transfer descriptor. Depending on the memory contents,
this could cause silent data corruption at an arbitrary address.
>> - thus you might get a case where hwTailP is 0 but hwHeadP is
>> non-zero, which would cause the HC to happily start dereferencing
>> the descriptor
David.B> If you assume a bug where the ED is freed but still in use,
David.B> that's hardly the only thing that'd go wrong!! You can't
David.B> use such a potential bug to prove something else is broken.
You lost me here. All I'm saying is that the current code has a
dangerous race that can corrupt memory, crash machines, or have all
sorts of other wild side-effects. I never claimed this bug had
anything todo with the BTC keyboard problem.
--david
next prev parent reply other threads:[~2004-03-10 18:07 UTC|newest]
Thread overview: 45+ messages / expand[flat|nested] mbox.gz Atom feed top
2003-10-27 22:35 serious 2.6 bug in USB subsystem? David Mosberger
2003-10-28 1:30 ` Greg KH
2003-10-28 3:00 ` David Mosberger
2003-10-30 15:11 ` [linux-usb-devel] " David Brownell
2003-10-30 20:15 ` David Mosberger
[not found] ` <16289.55171.278494.17172@napali.hpl.hp.com>
2003-10-31 16:23 ` David Brownell
2003-10-31 18:34 ` David Mosberger
2003-10-31 18:50 ` Valdis.Kletnieks
2003-10-31 19:28 ` David Brownell
2003-10-31 19:50 ` David Mosberger
2003-10-31 20:06 ` David S. Miller
2004-03-06 2:08 ` David Mosberger
2004-03-06 2:13 ` David Mosberger
2004-03-06 4:55 ` David Brownell
2004-03-06 5:49 ` David Mosberger
2004-03-06 7:21 ` David Mosberger
2004-03-06 8:39 ` David Mosberger
2004-03-06 16:37 ` David Brownell
2004-03-08 6:18 ` Grant Grundler
2004-03-08 18:58 ` David Mosberger
2004-03-08 21:48 ` David Brownell
2004-03-09 9:15 ` David Mosberger
2004-03-09 17:36 ` David Brownell
2004-03-09 17:58 ` David Mosberger
2004-03-09 20:39 ` David Brownell
2004-03-09 23:32 ` David Mosberger
2004-03-10 2:53 ` David Brownell
2004-03-10 6:11 ` David Mosberger
2004-03-10 6:59 ` David Mosberger
2004-03-10 7:52 ` Wouter Lueks
2004-03-10 16:49 ` David Mosberger
2004-03-10 19:49 ` Wouter Lueks
2004-03-10 16:22 ` David Brownell
2004-03-10 18:04 ` David Mosberger [this message]
2004-03-11 2:43 ` David Brownell
2004-03-11 5:35 ` David Mosberger
2004-03-10 19:29 ` Colin Leroy
2004-03-06 9:17 ` [linux-usb-devel] " David Mosberger
2004-03-06 17:30 ` David Brownell
2004-03-07 13:48 ` Matthias Andree
2004-03-08 18:49 ` David Mosberger
2003-11-03 3:46 ` David Brownell
2003-11-03 21:25 ` David Mosberger
2004-03-03 12:33 ` Wouter Lueks
2004-03-03 15:30 ` Wouter Lueks
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=16463.22710.230252.777998@napali.hpl.hp.com \
--to=davidm@napali.hpl.hp.com \
--cc=david-b@pacbell.net \
--cc=davidm@hpl.hp.com \
--cc=greg@kroah.com \
--cc=iod00d@hp.com \
--cc=linux-ia64@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-usb-devel@lists.sourceforge.net \
--cc=pochini@shiny.it \
--cc=vojtech@suse.cz \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).