New: Warning about NULL pointer dereference when attaching usb hd

Bugme-new Andrew Morton 4 participants 4 messages Jul 15, 2008 – Jul 16, 2008 3 messages not in the archive SCSI

Share & tools

A message that is not in the archive (sent off-list or not yet received): [email protected]/

A message that is not in the archive (sent off-list or not yet received): bug-11088-10286-V0hAGp6uBxO456/isadD/[email protected]/

Andrew Morton

author

2008-07-15 09:23 UTC #2 lore raw

(switched to email. Please respond via emailed reply-to-all, not via the bugzilla web interface).

Quoted 55 lines · On Tue, 15 Jul 2008 02:15:53 -0700 (PDT)…

http://bugzilla.kernel.org/show_bug.cgi?id=11088
           Summary: Warning about NULL pointer dereference when attaching
                    usb hd
           Product: Drivers
           Version: 2.5
     KernelVersion: 2.6.26
          Platform: All
        OS/Version: Linux
              Tree: Mainline
            Status: NEW
          Severity: normal
          Priority: P1
         Component: USB
        AssignedTo: [email protected]
        ReportedBy: [email protected]
I got this when attaching an external usb hd. Kernel is 2.6.26, I'll attach config.
sd 0:0:0:0: [sda] Attached SCSI disk
sd 0:0:0:0: Attached scsi generic sg0 type 0
BUG: unable to handle kernel NULL pointer dereference at 00000004
IP: [<f98c067b>] :usb_storage:slave_alloc+0x2b/0x60
*pde = 00000000
Oops: 0000 [#1]
Modules linked in: radeon drm usb_storage pcmcia nsc_ircc irda parport_pc
ehci_hcd uhci_hcd parport usbcore yenta_socket rsrc_nonstatic firewire_ohci pcmcia_core 8139cp firewire_core crc_itu_t ipw2200 8139too i2c_i801
Pid: 1354, comm: usb-stor-scan Not tainted (2.6.26 #1)
EIP: 0060:[<f98c067b>] EFLAGS: 00010202 CPU: 0
EIP is at slave_alloc+0x2b/0x60 [usb_storage]
EAX: 00000000 EBX: f6c6070c ECX: 00000202 EDX: f6cb8c00
ESI: f0403400 EDI: f6c10c14 EBP: f6c60400 ESP: f6d9bddc
DS: 007b ES: 007b FS: 0000 GS: 0000 SS: 0068
Process usb-stor-scan (pid: 1354, ti=f6d9a000 task=f7c534c0 task.ti=f6d9a000)
Stack: f0403400 f6c10c00 c02f0c73 f60fc938 00000000 00000000 f6c60400 00000000
       00000000 00000000 c02f1061 c04cca30 c049cb92 f60fc938 c04bebfe f6c643c8
       f6c643d0 f6c643e0 00000000 00000000 c04befed f6ea0288 00000000 f6c10c00
Call Trace:
 [<c02f0c73>] scsi_alloc_sdev+0x143/0x1b0
 [<c02f1061>] scsi_probe_and_add_lun+0x261/0x9a0
 [<c02f1c03>] __scsi_scan_target+0x2e3/0x610
 [<c0124f40>] process_timeout+0x0/0x10
 [<c0424347>] wait_for_common+0x77/0x110
 [<c0118ab0>] default_wake_function+0x0/0x10
 [<c02f1f87>] scsi_scan_channel+0x57/0xa0
 [<c02f2077>] scsi_scan_host_selected+0xa7/0x120
 [<c02f215b>] do_scsi_scan_host+0x6b/0x70
 [<f98c2625>] usb_stor_scan_thread+0x145/0x190 [usb_storage]
 [<c012e6e0>] autoremove_wake_function+0x0/0x50
 [<f98c24e0>] usb_stor_scan_thread+0x0/0x190 [usb_storage]
 [<c012e2d7>] kthread+0x37/0x70

Quoted 8 lines

 [<c012e2a0>] kthread+0x0/0x70
 [<c0103323>] kernel_thread_helper+0x7/0x14
 =======================
Code: 83 ec 08 89 74 24 04 89 c6 89 1c 24 8b 18 c6 40 57 24 81 c3 0c 03 00 00
8b 43 20 8b 53 0c c1 e8 0f 83 e0 0f 8b 84 82 8c 01 00 00 <0f> b7 50 04 8b 46 04
4a e8 b8 aa 96 c6 80 7b 3c 04 75 0e 8b 46
EIP: [<f98c067b>] slave_alloc+0x2b/0x60 [usb_storage] SS:ESP 0068:f6d9bddc
---[ end trace f3a5e784c4c8fadf ]---

--
To unsubscribe from this list: send the line "unsubscribe linux-usb" in the body of a message to [email protected] More majordomo info at http://vger.kernel.org/majordomo-info.html

A message that is not in the archive (sent off-list or not yet received): 20080715022323.4a6e470e.akpm-de/[email protected]

jidong xiao

2008-07-16 03:19 UTC #4 lore raw

Quoted 70 lines · Andrew Morton

(switched to email. Please respond via emailed reply-to-all, not via the bugzilla web interface).
Quoted 55 lines · On Tue, 15 Jul 2008 02:15:53 -0700 (PDT)…
http://bugzilla.kernel.org/show_bug.cgi?id=11088
           Summary: Warning about NULL pointer dereference when attaching
                    usb hd
           Product: Drivers
           Version: 2.5
     KernelVersion: 2.6.26
          Platform: All
        OS/Version: Linux
              Tree: Mainline
            Status: NEW
          Severity: normal
          Priority: P1
         Component: USB
        AssignedTo: [email protected]
        ReportedBy: [email protected]
I got this when attaching an external usb hd. Kernel is 2.6.26, I'll attach config.
sd 0:0:0:0: [sda] Attached SCSI disk
sd 0:0:0:0: Attached scsi generic sg0 type 0
BUG: unable to handle kernel NULL pointer dereference at 00000004
IP: [<f98c067b>] :usb_storage:slave_alloc+0x2b/0x60
*pde = 00000000
Oops: 0000 [#1]
Modules linked in: radeon drm usb_storage pcmcia nsc_ircc irda parport_pc
ehci_hcd uhci_hcd parport usbcore yenta_socket rsrc_nonstatic firewire_ohci pcmcia_core 8139cp firewire_core crc_itu_t ipw2200 8139too i2c_i801
Pid: 1354, comm: usb-stor-scan Not tainted (2.6.26 #1)
EIP: 0060:[<f98c067b>] EFLAGS: 00010202 CPU: 0
EIP is at slave_alloc+0x2b/0x60 [usb_storage]
EAX: 00000000 EBX: f6c6070c ECX: 00000202 EDX: f6cb8c00
ESI: f0403400 EDI: f6c10c14 EBP: f6c60400 ESP: f6d9bddc
DS: 007b ES: 007b FS: 0000 GS: 0000 SS: 0068
Process usb-stor-scan (pid: 1354, ti=f6d9a000 task=f7c534c0 task.ti=f6d9a000)
Stack: f0403400 f6c10c00 c02f0c73 f60fc938 00000000 00000000 f6c60400 00000000
       00000000 00000000 c02f1061 c04cca30 c049cb92 f60fc938 c04bebfe f6c643c8
       f6c643d0 f6c643e0 00000000 00000000 c04befed f6ea0288 00000000 f6c10c00
Call Trace:
 [<c02f0c73>] scsi_alloc_sdev+0x143/0x1b0
 [<c02f1061>] scsi_probe_and_add_lun+0x261/0x9a0
 [<c02f1c03>] __scsi_scan_target+0x2e3/0x610
 [<c0124f40>] process_timeout+0x0/0x10
 [<c0424347>] wait_for_common+0x77/0x110
 [<c0118ab0>] default_wake_function+0x0/0x10
 [<c02f1f87>] scsi_scan_channel+0x57/0xa0
 [<c02f2077>] scsi_scan_host_selected+0xa7/0x120
 [<c02f215b>] do_scsi_scan_host+0x6b/0x70
 [<f98c2625>] usb_stor_scan_thread+0x145/0x190 [usb_storage]
 [<c012e6e0>] autoremove_wake_function+0x0/0x50
 [<f98c24e0>] usb_stor_scan_thread+0x0/0x190 [usb_storage]
 [<c012e2d7>] kthread+0x37/0x70
Quoted 8 lines
 [<c012e2a0>] kthread+0x0/0x70
 [<c0103323>] kernel_thread_helper+0x7/0x14
 =======================
Code: 83 ec 08 89 74 24 04 89 c6 89 1c 24 8b 18 c6 40 57 24 81 c3 0c 03 00 00
8b 43 20 8b 53 0c c1 e8 0f 83 e0 0f 8b 84 82 8c 01 00 00 <0f> b7 50 04 8b 46 04
4a e8 b8 aa 96 c6 80 7b 3c 04 75 0e 8b 46
EIP: [<f98c067b>] slave_alloc+0x2b/0x60 [usb_storage] SS:ESP 0068:f6d9bddc
---[ end trace f3a5e784c4c8fadf ]---

Quoted 5 lines

--
To unsubscribe from this list: send the line "unsubscribe linux-usb" in the body of a message to [email protected] More majordomo info at http://vger.kernel.org/majordomo-info.html

Hi, Hanno,

1. Can this bug be reproduced?
2. Can you try it with older kernel?such as 2.6.25 or some other versions prior to 2.6.26.

Thanks
Jason Xiao
--
To unsubscribe from this list: send the line "unsubscribe linux-usb" in the body of a message to [email protected] More majordomo info at http://vger.kernel.org/majordomo-info.html

jidong xiao

2008-07-16 05:39 UTC #5 lore raw

Quoted 78 lines · jidong xiao

Quoted 70 lines · Andrew Morton
(switched to email. Please respond via emailed reply-to-all, not via the bugzilla web interface).
Quoted 55 lines · On Tue, 15 Jul 2008 02:15:53 -0700 (PDT) [email protected] wrote:
http://bugzilla.kernel.org/show_bug.cgi?id=11088
           Summary: Warning about NULL pointer dereference when attaching
                    usb hd
           Product: Drivers
           Version: 2.5
     KernelVersion: 2.6.26
          Platform: All
        OS/Version: Linux
              Tree: Mainline
            Status: NEW
          Severity: normal
          Priority: P1
         Component: USB
        AssignedTo: [email protected]
        ReportedBy: [email protected]
I got this when attaching an external usb hd. Kernel is 2.6.26, I'll attach config.
sd 0:0:0:0: [sda] Attached SCSI disk
sd 0:0:0:0: Attached scsi generic sg0 type 0
BUG: unable to handle kernel NULL pointer dereference at 00000004
IP: [<f98c067b>] :usb_storage:slave_alloc+0x2b/0x60
*pde = 00000000
Oops: 0000 [#1]
Modules linked in: radeon drm usb_storage pcmcia nsc_ircc irda parport_pc
ehci_hcd uhci_hcd parport usbcore yenta_socket rsrc_nonstatic firewire_ohci pcmcia_core 8139cp firewire_core crc_itu_t ipw2200 8139too i2c_i801
Pid: 1354, comm: usb-stor-scan Not tainted (2.6.26 #1)
EIP: 0060:[<f98c067b>] EFLAGS: 00010202 CPU: 0
EIP is at slave_alloc+0x2b/0x60 [usb_storage]
EAX: 00000000 EBX: f6c6070c ECX: 00000202 EDX: f6cb8c00
ESI: f0403400 EDI: f6c10c14 EBP: f6c60400 ESP: f6d9bddc
DS: 007b ES: 007b FS: 0000 GS: 0000 SS: 0068
Process usb-stor-scan (pid: 1354, ti=f6d9a000 task=f7c534c0 task.ti=f6d9a000)
Stack: f0403400 f6c10c00 c02f0c73 f60fc938 00000000 00000000 f6c60400 00000000
       00000000 00000000 c02f1061 c04cca30 c049cb92 f60fc938 c04bebfe f6c643c8
       f6c643d0 f6c643e0 00000000 00000000 c04befed f6ea0288 00000000 f6c10c00
Call Trace:
 [<c02f0c73>] scsi_alloc_sdev+0x143/0x1b0
 [<c02f1061>] scsi_probe_and_add_lun+0x261/0x9a0
 [<c02f1c03>] __scsi_scan_target+0x2e3/0x610
 [<c0124f40>] process_timeout+0x0/0x10
 [<c0424347>] wait_for_common+0x77/0x110
 [<c0118ab0>] default_wake_function+0x0/0x10
 [<c02f1f87>] scsi_scan_channel+0x57/0xa0
 [<c02f2077>] scsi_scan_host_selected+0xa7/0x120
 [<c02f215b>] do_scsi_scan_host+0x6b/0x70
 [<f98c2625>] usb_stor_scan_thread+0x145/0x190 [usb_storage]
 [<c012e6e0>] autoremove_wake_function+0x0/0x50
 [<f98c24e0>] usb_stor_scan_thread+0x0/0x190 [usb_storage]
 [<c012e2d7>] kthread+0x37/0x70
Quoted 8 lines
 [<c012e2a0>] kthread+0x0/0x70
 [<c0103323>] kernel_thread_helper+0x7/0x14
 =======================
Code: 83 ec 08 89 74 24 04 89 c6 89 1c 24 8b 18 c6 40 57 24 81 c3 0c 03 00 00
8b 43 20 8b 53 0c c1 e8 0f 83 e0 0f 8b 84 82 8c 01 00 00 <0f> b7 50 04 8b 46 04
4a e8 b8 aa 96 c6 80 7b 3c 04 75 0e 8b 46
EIP: [<f98c067b>] slave_alloc+0x2b/0x60 [usb_storage] SS:ESP 0068:f6d9bddc
---[ end trace f3a5e784c4c8fadf ]---
Quoted 5 lines
--
To unsubscribe from this list: send the line "unsubscribe linux-usb" in the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html

Quoted 9 lines

Hi, Hanno,
1. Can this bug be reproduced?
2. Can you try it with older kernel?such as 2.6.25 or some other versions prior to 2.6.26.
Thanks
Jason Xiao

Hi, Alan,

I disassembled the source code via kdb. slave_alloc+0x2b: call blk_queue_update_dma_alignment scsi_alloc_sdev+0x143: call scsi_adjust_queue_depth

The Oops is triggered while blk_queue_update_dma_alignment is being called. The relevant piece of code is:

     73 static int slave_alloc (struct scsi_device *sdev)
     74 {
     75         struct us_data *us = host_to_us(sdev->host);
     76         struct usb_host_endpoint *bulk_in_ep;
     77
     78         /*
     79          * Set the INQUIRY transfer length to 36.  We don't use any of
     80          * the extra data and many devices choke if asked for more or
     81          * less than 36 bytes.
     82          */
     83         sdev->inquiry_len = 36;
     84
     85         /* Scatter-gather buffers (all but the last) must have a length
     86          * divisible by the bulk maxpacket size.  Otherwise a
data packet
     87          * would end up being short, causing a premature end to the data
     88          * transfer.  We'll use the maxpacket value of the bulk-IN pipe
     89          * to set the SCSI device queue's DMA alignment mask.
     90          */
     91         bulk_in_ep =
us->pusb_dev->ep_in[usb_pipeendpoint(us->recv_bulk_pipe)];
     92         blk_queue_update_dma_alignment(sdev->request_queue,
     93

le16_to_cpu(bulk_in_ep->desc.wMaxPacketSize) - 1);
94 /* wMaxPacketSize must be a power of 2 */
95

So the problems is, either sdev->request_queue or bulk_in_ep is NULL pointer. In my opinion, bulk_in_ep is more likely to be a NULL pointer as it is just calculated in the prior line.

What do you think about this issue?

Regards
Jason

Alan Stern

2008-07-16 13:40 UTC #6 lore raw

Quoted 11 lines · jidong xiao

Hi, Alan,
I disassembled the source code via kdb. slave_alloc+0x2b: call blk_queue_update_dma_alignment scsi_alloc_sdev+0x143: call scsi_adjust_queue_depth
So the problems is, either sdev->request_queue or bulk_in_ep is NULL pointer. In my opinion, bulk_in_ep is more likely to be a NULL pointer as it is just calculated in the prior line.
What do you think about this issue?

Read the full report in Bugzilla and you'll see.

Alan Stern