On Tue, 17 Aug 2010, Stephen Hemminger wrote:
> Running last-week kernel, saw this in the log every time I flip my KVM switch.
>
>
> Aug 17 14:29:10 nehalam kernel: [ 7523.675554] input: Belkin Corporation Flip CC as /devices/pci0000:00/0000:00:1d.7/usb2/2-1/2-1.1/2-1.1:1.0/input/input27
> Aug 17 14:29:10 nehalam kernel: [ 7523.675701] belkin 0003:050D:3201.0019: input,hiddev0,hidraw4: USB HID v1.10 Device [Belkin Corporation Flip CC] on usb-0000:00:1d.7-1.1/input0
> Aug 17 14:29:10 nehalam kernel: [ 7523.723485] usb 2-1.4: USB disconnect, address 20
> Aug 17 14:29:11 nehalam kernel: [ 7524.235309] usb 2-1.3: USB disconnect, address 21
> Aug 17 14:42:46 nehalam kernel: [ 8338.552566] usb 2-1.1: USB disconnect, address 22
> Aug 17 14:42:46 nehalam kernel: [ 8338.552614] ------------[ cut here ]------------
> Aug 17 14:42:46 nehalam kernel: [ 8338.552620] WARNING: at lib/kobject.c:595 kobject_put+0x50/0x60()
> Aug 17 14:42:46 nehalam kernel: [ 8338.552623] Hardware name: System Product Name
> Aug 17 14:42:46 nehalam kernel: [ 8338.552625] kobject: '(null)' (ffff88017177d898): is not initialized, yet kobject_put() is being called.
> Aug 17 14:42:46 nehalam kernel: [ 8338.552628] Modules linked in: hid_belkin sha1_generic arc4 ppp_mppe ppp_async crc_ccitt autofs4 binfmt_misc ipt_MASQUERADE iptable_nat nf_nat nf_conntrack_ipv4 nf_defrag_ipv4 xt_state nf_conntrack ipt_REJECT xt_tcpudp iptable_filter ip_tables x_tables bridge stp llc kvm_intel kvm radeon ttm drm_kms_helper drm i2c_algo_bit snd_hda_codec_analog ipv6 snd_hda_intel snd_hda_codec snd_hwdep snd_pcm_oss snd_mixer_oss snd_pcm snd_seq_dummy snd_seq_oss snd_seq_midi snd_rawmidi snd_seq_midi_event snd_seq snd_timer snd_seq_device asus_atk0110 snd psmouse serio_raw soundcore snd_page_alloc usbhid mvsas libsas scsi_transport_sas floppy sky2 e1000e
> Aug 17 14:42:46 nehalam kernel: [ 8338.552678] Pid: 69, comm: khubd Tainted: G W 2.6.35+ #35
> Aug 17 14:42:46 nehalam kernel: [ 8338.552680] Call Trace:
> Aug 17 14:42:46 nehalam kernel: [ 8338.552687] [<ffffffff8104821a>] warn_slowpath_common+0x7a/0xb0
> Aug 17 14:42:46 nehalam kernel: [ 8338.552693] [<ffffffff810482f1>] warn_slowpath_fmt+0x41/0x50
> Aug 17 14:42:46 nehalam kernel: [ 8338.552697] [<ffffffff81249db0>] kobject_put+0x50/0x60
> Aug 17 14:42:46 nehalam kernel: [ 8338.552701] [<ffffffff812f3592>] put_device+0x12/0x20
> Aug 17 14:42:46 nehalam kernel: [ 8338.552706] [<ffffffff813b95b3>] hid_destroy_device+0x43/0x50
> Aug 17 14:42:46 nehalam kernel: [ 8338.552713] [<ffffffffa0044a06>] usbhid_disconnect+0x26/0x50 [usbhid]
> Aug 17 14:42:46 nehalam kernel: [ 8338.552719] [<ffffffff81378a35>] usb_unbind_interface+0x55/0x1a0
> Aug 17 14:42:46 nehalam kernel: [ 8338.552725] [<ffffffff812f73d0>] __device_release_driver+0x70/0xe0
> Aug 17 14:42:46 nehalam kernel: [ 8338.552730] [<ffffffff812f7538>] device_release_driver+0x28/0x40
> Aug 17 14:42:46 nehalam kernel: [ 8338.552734] [<ffffffff812f64e9>] bus_remove_device+0xa9/0xe0
> Aug 17 14:42:46 nehalam kernel: [ 8338.552737] [<ffffffff812f41e7>] device_del+0x127/0x1d0
> Aug 17 14:42:46 nehalam kernel: [ 8338.552742] [<ffffffff813753c7>] usb_disable_device+0xa7/0x130
> Aug 17 14:42:46 nehalam kernel: [ 8338.552745] [<ffffffff8136e941>] usb_disconnect+0x91/0x130
> Aug 17 14:42:46 nehalam kernel: [ 8338.552749] [<ffffffff8136ffdc>] hub_thread+0x48c/0x1220
> Aug 17 14:42:46 nehalam kernel: [ 8338.552754] [<ffffffff81040651>] ? dequeue_entity+0x1a1/0x1e0
> Aug 17 14:42:46 nehalam kernel: [ 8338.552759] [<ffffffff810661f0>] ? autoremove_wake_function+0x0/0x40
> Aug 17 14:42:46 nehalam kernel: [ 8338.552763] [<ffffffff8136fb50>] ? hub_thread+0x0/0x1220
> Aug 17 14:42:46 nehalam kernel: [ 8338.552766] [<ffffffff81065cfe>] kthread+0x8e/0xa0
> Aug 17 14:42:46 nehalam kernel: [ 8338.552771] [<ffffffff81003454>] kernel_thread_helper+0x4/0x10
> Aug 17 14:42:46 nehalam kernel: [ 8338.552775] [<ffffffff81065c70>] ? kthread+0x0/0xa0
> Aug 17 14:42:46 nehalam kernel: [ 8338.552778] [<ffffffff81003450>] ? kernel_thread_helper+0x0/0x10
> Aug 17 14:42:46 nehalam kernel: [ 8338.552781] ---[ end trace 2721da84d6efea62 ]---
Hi Stephen,
I have the patch below queued in my tree, and I am planning to push it to
Linus soon. It will almost certainly fix your issue, but I'll appreciate
if you can confirm that. Thanks.
commit 9c9e54a8df0be48aa359744f412377cc55c3b7d2
Author: Jiri Kosina <jkosina@xxxxxxx>
Date: Fri Aug 13 12:19:45 2010 +0200
HID: hiddev: fix memory corruption due to invalid intfdata
Commit bd25f4dd6972755579d0 ("HID: hiddev: use usb_find_interface,
get rid of BKL") introduced using of private intfdata in hiddev for
purpose of storing hiddev pointer.
This is a problem, because intf pointer is already being set to struct
hid_device pointer by HID core. This obviously lead to memory corruptions
at device disconnect time, such as
WARNING: at lib/kobject.c:595 kobject_put+0x37/0x4b()
kobject: '(null)' (ffff88011e9cd898): is not initialized, yet kobject_put() is being called.
Convert hiddev into accessing hiddev through struct hid_device which is
in intfdata already.
Reported-and-tested-by: Markus Trippelsdorf <markus@xxxxxxxxxxxxxxx>
Reported-and-tested-by: Heinz Diehl <htd@xxxxxxxxxx>
Reported-and-tested-by: Alan Ott <alan@xxxxxxxxxxx>
Signed-off-by: Jiri Kosina <jkosina@xxxxxxx>
diff --git a/drivers/hid/usbhid/hiddev.c b/drivers/hid/usbhid/hiddev.c
index f285017..0a29c51 100644
--- a/drivers/hid/usbhid/hiddev.c
+++ b/drivers/hid/usbhid/hiddev.c
@@ -266,13 +266,15 @@ static int hiddev_open(struct inode *inode, struct file *file)
{
struct hiddev_list *list;
struct usb_interface *intf;
+ struct hid_device *hid;
struct hiddev *hiddev;
int res;
intf = usb_find_interface(&hiddev_driver, iminor(inode));
if (!intf)
return -ENODEV;
- hiddev = usb_get_intfdata(intf);
+ hid = usb_get_intfdata(intf);
+ hiddev = hid->hiddev;
if (!(list = kzalloc(sizeof(struct hiddev_list), GFP_KERNEL)))
return -ENOMEM;
@@ -890,7 +892,6 @@ int hiddev_connect(struct hid_device *hid, unsigned int force)
hid->hiddev = hiddev;
hiddev->hid = hid;
hiddev->exist = 1;
- usb_set_intfdata(usbhid->intf, usbhid);
retval = usb_register_dev(usbhid->intf, &hiddev_class);
if (retval) {
err_hid("Not able to get a minor for this device.");
--
Jiri Kosina
SUSE Labs, Novell Inc.
--
To unsubscribe from this list: send the line "unsubscribe linux-usb" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
