From: "Bjørn Mork" <bjorn@mork.no>
To: Wim Osterholt <wim@djo.tudelft.nl>
Cc: Oliver Neukum <oneukum@suse.com>,
poma <pomidorabelisima@gmail.com>,
linux-kernel@vger.kernel.org, linux-usb@vger.kernel.org
Subject: Re: crash by cdc_acm driver in kernels 4.8-rc1/5
Date: Tue, 22 Nov 2016 19:08:30 +0100 [thread overview]
Message-ID: <87oa17o09t.fsf@miraculix.mork.no> (raw)
In-Reply-To: <20161122153852.GA32591@djo.tudelft.nl> (Wim Osterholt's message of "Tue, 22 Nov 2016 16:38:52 +0100")
Wim Osterholt <wim@djo.tudelft.nl> writes:
> On Mon, Nov 21, 2016 at 02:19:32PM +0100, Oliver Neukum wrote:
>
>> I don't understand it, bit please test the attached patch
>> with dynamic debugging for cdc-acm and the kernel log level
>> at maximum.
>
>> diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
>> index 6895f9e..f03b5db 100644
>> --- a/drivers/usb/class/cdc-acm.c
>> +++ b/drivers/usb/class/cdc-acm.c
>> @@ -1188,6 +1188,12 @@ static int acm_probe(struct usb_interface *intf,
>>
>> cdc_parse_cdc_header(&h, intf, buffer, buflen);
>> union_header = h.usb_cdc_union_desc;
>> +
>> + dev_dbg(&intf->dev, "Parsed device header\n");
>> + dev_dbg(&intf->dev, "Union descriptor %p\n", h.usb_cdc_union_desc);
>> + dev_dbg(&intf->dev, "ACM descriptor %p\n", h.usb_cdc_acm_descriptor);
>> + dev_dbg(&intf->dev, "Country descriptor %p\n", h.usb_cdc_country_functional_desc);
>> +
>> cmgmd = h.usb_cdc_call_mgmt_descriptor;
>> if (cmgmd)
>> call_intf_num = cmgmd->bDataInterface;
>
>
> On kernel 4.8.8 this crashes hard and produces over a serial link:
Huh? That device shouldn't ever enter that code path AFAICS.
Unless.... you wouldn't happen to add a dynamic entry for this device,
would you? What's the output of
cat /sys/bus/usb/drivers/cdc_acm/new_id
?
We should probably survive it, but I think the current acm_probe() is
going to barf hard on the last data interface, if probed without the
default NO_UNION_NORMAL quirk. cdc_parse_cdc_header() will happily
parse all the functional descriptors, including the union pointing to
interfaces 0 and 1. I might be missing it, but I cannot see any sanity
check verifying that the currently probed interface is actually part of
the set of interfaces pointed to by the union. There is a sanity check
for the availability of the data interface, but there is none for the
control interface (the assumption of course that that's the interface
we're probing).
I think we need a bit more sanity checking of the union. This is likely
a generic problem for any CDC driver, so it is worth considering adding
a shared function for that.
And all this fails to explain anything if you didn't add the device
dynamically, of course...
Bjørn
next prev parent reply other threads:[~2016-11-22 18:09 UTC|newest]
Thread overview: 49+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-09-08 11:58 crash by cdc_acm driver in kernels 4.8-rc1/5 Wim Osterholt
2016-09-08 12:20 ` Oliver Neukum
2016-09-08 12:58 ` Wim Osterholt
2016-09-08 13:05 ` Oliver Neukum
2016-09-08 15:00 ` Wim Osterholt
2016-09-08 16:54 ` Wim Osterholt
2016-09-09 13:24 ` Wim Osterholt
2016-09-12 2:43 ` Wim Osterholt
2016-09-20 13:05 ` Oliver Neukum
2016-09-20 15:45 ` Wim Osterholt
2016-09-21 12:21 ` Oliver Neukum
2016-09-21 16:21 ` Wim Osterholt
2016-09-21 16:41 ` Wim Osterholt
2016-09-22 14:40 ` Oliver Neukum
2016-09-22 17:56 ` Wim Osterholt
2016-09-22 19:21 ` Wim Osterholt
2016-09-23 10:04 ` Wim Osterholt
2016-09-27 16:34 ` Wim Osterholt
2016-09-28 9:16 ` Oliver Neukum
2016-09-28 14:46 ` Wim Osterholt
2016-09-28 15:08 ` Wim Osterholt
2016-09-28 15:23 ` Oliver Neukum
2016-09-29 13:26 ` Wim Osterholt
2016-10-06 10:53 ` Oliver Neukum
2016-10-17 14:10 ` Oliver Neukum
2016-10-17 15:20 ` Wim Osterholt
2016-10-18 12:18 ` Oliver Neukum
2016-10-18 14:51 ` Wim Osterholt
2016-11-05 13:34 ` Wim Osterholt
2016-11-15 0:16 ` Wim Osterholt
2016-11-15 11:07 ` Oliver Neukum
2016-11-15 11:26 ` poma
2016-11-15 13:29 ` Wim Osterholt
2016-11-16 12:34 ` Oliver Neukum
2016-11-16 15:07 ` Wim Osterholt
2016-11-17 1:57 ` Wim Osterholt
2016-11-17 9:14 ` Wim Osterholt
2016-11-17 16:11 ` Wim Osterholt
2016-11-21 13:19 ` Oliver Neukum
2016-11-21 15:58 ` Wim Osterholt
2016-11-21 20:23 ` Wim Osterholt
2016-11-21 23:49 ` poma
2016-11-22 17:50 ` Bjørn Mork
2016-11-23 0:48 ` Wim Osterholt
2016-11-22 15:38 ` Wim Osterholt
2016-11-22 18:08 ` Bjørn Mork [this message]
2016-11-23 0:54 ` Wim Osterholt
2016-11-23 7:37 ` Bjørn Mork
2016-11-23 15:02 ` Alan Stern
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=87oa17o09t.fsf@miraculix.mork.no \
--to=bjorn@mork.no \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-usb@vger.kernel.org \
--cc=oneukum@suse.com \
--cc=pomidorabelisima@gmail.com \
--cc=wim@djo.tudelft.nl \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).