linaro-kernel

linaro-kernel@lists.linaro.org

10095 discussions

[PATCH V2] usb: hub: Fix unbalanced reference count/memory leak/deadlocks

by Viresh Kumar

Memory leak and unbalanced reference count: If the hub gets disconnected while the core is still activating it, this can result in leaking memory of few USB structures. This will happen if we have done a kref_get() from hub_activate() and scheduled a delayed work item for HUB_INIT2/3. Now if hub_disconnect() gets called before the delayed work expires, then we will cancel the work from hub_quiesce(), but wouldn't do a kref_put(). And so the unbalance. kmemleak reports this as (with the commit e50293ef9775 backported to 3.10 kernel with other changes, though the same is true for mainline as well): unreferenced object 0xffffffc08af5b800 (size 1024): comm "khubd", pid 73, jiffies 4295051211 (age 6482.350s) hex dump (first 32 bytes): 30 68 f3 8c c0 ff ff ff 00 a0 b2 2e c0 ff ff ff 0h.............. 01 00 00 00 00 00 00 00 00 94 7d 40 c0 ff ff ff ..........}@.... backtrace: [<ffffffc0003079ec>] create_object+0x148/0x2a0 [<ffffffc000cc150c>] kmemleak_alloc+0x80/0xbc [<ffffffc000303a7c>] kmem_cache_alloc_trace+0x120/0x1ac [<ffffffc0006fa610>] hub_probe+0x120/0xb84 [<ffffffc000702b20>] usb_probe_interface+0x1ec/0x298 [<ffffffc0005d50cc>] driver_probe_device+0x160/0x374 [<ffffffc0005d5308>] __device_attach+0x28/0x4c [<ffffffc0005d3164>] bus_for_each_drv+0x78/0xac [<ffffffc0005d4ee0>] device_attach+0x6c/0x9c [<ffffffc0005d42b8>] bus_probe_device+0x28/0xa0 [<ffffffc0005d23a4>] device_add+0x324/0x604 [<ffffffc000700fcc>] usb_set_configuration+0x660/0x6cc [<ffffffc00070a350>] generic_probe+0x44/0x84 [<ffffffc000702914>] usb_probe_device+0x54/0x74 [<ffffffc0005d50cc>] driver_probe_device+0x160/0x374 [<ffffffc0005d5308>] __device_attach+0x28/0x4c Deadlocks: If the hub gets disconnected early enough (i.e. before INIT2/INIT3 are finished and the init_work is still queued), the core may call hub_quiesce() after acquiring interface device locks and it will wait for the work to be cancelled synchronously. But if the work handler is already running in parallel, it may try to acquire the same interface device lock and this may result in deadlock. Fix both the issues by removing the call to cancel_delayed_work_sync(). CC: <stable(a)vger.kernel.org> #4.4+ Fixes: e50293ef9775 ("USB: fix invalid memory access in hub_activate()") Reported-by: Manu Gautam <mgautam(a)codeaurora.org> Signed-off-by: Viresh Kumar <viresh.kumar(a)linaro.org> Acked-by: Alan Stern <stern(a)rowland.harvard.edu> --- V1->V2: - Solve the deadlock problem as well - Added Ack from Alan as he was happy with this solution in advance :) - Dropped cancel-work and kref-put from V1 drivers/usb/core/hub.c | 2 -- 1 file changed, 2 deletions(-) diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c index bee13517676f..3ccffac0f647 100644 --- a/drivers/usb/core/hub.c +++ b/drivers/usb/core/hub.c @@ -1315,8 +1315,6 @@ static void hub_quiesce(struct usb_hub *hub, enum hub_quiescing_type type) struct usb_device *hdev = hub->hdev; int i; - cancel_delayed_work_sync(&hub->init_work); - /* hub_wq and related activity won't re-trigger */ hub->quiescing = 1; -- 2.7.4

9 years, 1 month

master build: 2 failures 1 warnings (v4.7-11584-gc1ece76)

by Build bot for Mark Brown

Tree/Branch: master Git describe: v4.7-11584-gc1ece76 Commit: c1ece76719 Merge tag 'media/v4.8-5' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media Build Time: 76 min 29 sec Passed: 7 / 9 ( 77.78 %) Failed: 2 / 9 ( 22.22 %) Errors: 0 Warnings: 1 Section Mismatches: 0 Failed defconfigs: arm-allmodconfig Errors: ------------------------------------------------------------------------------- defconfigs with issues (other than build errors): 1 warnings 0 mismatches : arm-allmodconfig ------------------------------------------------------------------------------- Warnings Summary: 1 1 ../drivers/tty/serial/8250/8250_fintek.c:34:0: warning: "IRQ_MODE" redefined =============================================================================== Detailed per-defconfig build reports below: ------------------------------------------------------------------------------- arm-allmodconfig : FAIL, 0 errors, 1 warnings, 0 section mismatches Warnings: ../drivers/tty/serial/8250/8250_fintek.c:34:0: warning: "IRQ_MODE" redefined ------------------------------------------------------------------------------- Passed with no errors, warnings or mismatches: arm64-allnoconfig arm64-allmodconfig arm-multi_v5_defconfig arm-multi_v7_defconfig x86_64-defconfig arm-allnoconfig x86_64-allnoconfig arm64-defconfig close failed in file object destructor: sys.excepthook is missing lost sys.stderr

9 years, 1 month

next-20160804 build: 0 failures 1 warnings (next-20160804)

by Build bot for Mark Brown

Tree/Branch: next-20160804 Git describe: next-20160804 Commit: 4d9dc2a0ba Add linux-next specific files for 20160804 Build Time: 87 min 49 sec Passed: 9 / 9 (100.00 %) Failed: 0 / 9 ( 0.00 %) Errors: 0 Warnings: 1 Section Mismatches: 0 ------------------------------------------------------------------------------- defconfigs with issues (other than build errors): 1 warnings 0 mismatches : arm-allmodconfig ------------------------------------------------------------------------------- Warnings Summary: 1 1 ../drivers/tty/serial/8250/8250_fintek.c:34:0: warning: "IRQ_MODE" redefined =============================================================================== Detailed per-defconfig build reports below: ------------------------------------------------------------------------------- arm-allmodconfig : PASS, 0 errors, 1 warnings, 0 section mismatches Warnings: ../drivers/tty/serial/8250/8250_fintek.c:34:0: warning: "IRQ_MODE" redefined ------------------------------------------------------------------------------- Passed with no errors, warnings or mismatches: arm64-allnoconfig arm64-allmodconfig arm-multi_v5_defconfig arm-multi_v7_defconfig x86_64-defconfig arm-allnoconfig x86_64-allnoconfig arm64-defconfig close failed in file object destructor: sys.excepthook is missing lost sys.stderr

9 years, 1 month

master build: 2 failures 1 warnings (v4.7-11544-g96b5852)

by Build bot for Mark Brown

Tree/Branch: master Git describe: v4.7-11544-g96b5852 Commit: 96b585267f Revert "ACPI / hotplug / PCI: Runtime resume bridge before rescan" Build Time: 125 min 47 sec Passed: 7 / 9 ( 77.78 %) Failed: 2 / 9 ( 22.22 %) Errors: 0 Warnings: 1 Section Mismatches: 0 Failed defconfigs: arm-allmodconfig Errors: ------------------------------------------------------------------------------- defconfigs with issues (other than build errors): 1 warnings 0 mismatches : arm-allmodconfig ------------------------------------------------------------------------------- Warnings Summary: 1 1 ../drivers/tty/serial/8250/8250_fintek.c:34:0: warning: "IRQ_MODE" redefined =============================================================================== Detailed per-defconfig build reports below: ------------------------------------------------------------------------------- arm-allmodconfig : FAIL, 0 errors, 1 warnings, 0 section mismatches Warnings: ../drivers/tty/serial/8250/8250_fintek.c:34:0: warning: "IRQ_MODE" redefined ------------------------------------------------------------------------------- Passed with no errors, warnings or mismatches: arm64-allnoconfig arm64-allmodconfig arm-multi_v5_defconfig arm-multi_v7_defconfig x86_64-defconfig arm-allnoconfig x86_64-allnoconfig arm64-defconfig close failed in file object destructor: sys.excepthook is missing lost sys.stderr

9 years, 1 month

master build: 2 failures 1 warnings (v4.7-11543-g4620a06)

by Build bot for Mark Brown

Tree/Branch: master Git describe: v4.7-11543-g4620a06 Commit: 4620a06e4b shmem: Fix link error if huge pages support is disabled Build Time: 77 min 7 sec Passed: 7 / 9 ( 77.78 %) Failed: 2 / 9 ( 22.22 %) Errors: 0 Warnings: 1 Section Mismatches: 0 Failed defconfigs: arm-allmodconfig Errors: ------------------------------------------------------------------------------- defconfigs with issues (other than build errors): 1 warnings 0 mismatches : arm-allmodconfig ------------------------------------------------------------------------------- Warnings Summary: 1 1 ../drivers/tty/serial/8250/8250_fintek.c:34:0: warning: "IRQ_MODE" redefined =============================================================================== Detailed per-defconfig build reports below: ------------------------------------------------------------------------------- arm-allmodconfig : FAIL, 0 errors, 1 warnings, 0 section mismatches Warnings: ../drivers/tty/serial/8250/8250_fintek.c:34:0: warning: "IRQ_MODE" redefined ------------------------------------------------------------------------------- Passed with no errors, warnings or mismatches: arm64-allnoconfig arm64-allmodconfig arm-multi_v5_defconfig arm-multi_v7_defconfig x86_64-defconfig arm-allnoconfig x86_64-allnoconfig arm64-defconfig close failed in file object destructor: sys.excepthook is missing lost sys.stderr

9 years, 1 month

master build: 2 failures 1 warnings (v4.7-11541-gbf0f500)

by Build bot for Mark Brown

Tree/Branch: master Git describe: v4.7-11541-gbf0f500 Commit: bf0f500bd0 Merge tag 'trace-v4.8-1' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace Build Time: 77 min 30 sec Passed: 7 / 9 ( 77.78 %) Failed: 2 / 9 ( 22.22 %) Errors: 0 Warnings: 1 Section Mismatches: 0 Failed defconfigs: arm-allmodconfig Errors: ------------------------------------------------------------------------------- defconfigs with issues (other than build errors): 1 warnings 0 mismatches : arm-allmodconfig ------------------------------------------------------------------------------- Warnings Summary: 1 1 ../drivers/tty/serial/8250/8250_fintek.c:34:0: warning: "IRQ_MODE" redefined =============================================================================== Detailed per-defconfig build reports below: ------------------------------------------------------------------------------- arm-allmodconfig : FAIL, 0 errors, 1 warnings, 0 section mismatches Warnings: ../drivers/tty/serial/8250/8250_fintek.c:34:0: warning: "IRQ_MODE" redefined ------------------------------------------------------------------------------- Passed with no errors, warnings or mismatches: arm64-allnoconfig arm64-allmodconfig arm-multi_v5_defconfig arm-multi_v7_defconfig x86_64-defconfig arm-allnoconfig x86_64-allnoconfig arm64-defconfig close failed in file object destructor: sys.excepthook is missing lost sys.stderr

9 years, 1 month

master build: 2 failures 1 warnings (v4.7-11535-gf093615)

by Build bot for Mark Brown

Tree/Branch: master Git describe: v4.7-11535-gf093615 Commit: f0936155f2 Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net Build Time: 77 min 39 sec Passed: 7 / 9 ( 77.78 %) Failed: 2 / 9 ( 22.22 %) Errors: 0 Warnings: 1 Section Mismatches: 0 Failed defconfigs: arm-allmodconfig Errors: ------------------------------------------------------------------------------- defconfigs with issues (other than build errors): 1 warnings 0 mismatches : arm-allmodconfig ------------------------------------------------------------------------------- Warnings Summary: 1 1 ../drivers/tty/serial/8250/8250_fintek.c:34:0: warning: "IRQ_MODE" redefined =============================================================================== Detailed per-defconfig build reports below: ------------------------------------------------------------------------------- arm-allmodconfig : FAIL, 0 errors, 1 warnings, 0 section mismatches Warnings: ../drivers/tty/serial/8250/8250_fintek.c:34:0: warning: "IRQ_MODE" redefined ------------------------------------------------------------------------------- Passed with no errors, warnings or mismatches: arm64-allnoconfig arm64-allmodconfig arm-multi_v5_defconfig arm-multi_v7_defconfig x86_64-defconfig arm-allnoconfig x86_64-allnoconfig arm64-defconfig close failed in file object destructor: sys.excepthook is missing lost sys.stderr

9 years, 1 month

next-20160803 build: 0 failures 1 warnings (next-20160803)

by Build bot for Mark Brown

Tree/Branch: next-20160803 Git describe: next-20160803 Commit: 7a4be45ba2 Add linux-next specific files for 20160803 Build Time: 87 min 53 sec Passed: 9 / 9 (100.00 %) Failed: 0 / 9 ( 0.00 %) Errors: 0 Warnings: 1 Section Mismatches: 0 ------------------------------------------------------------------------------- defconfigs with issues (other than build errors): 1 warnings 0 mismatches : arm-allmodconfig ------------------------------------------------------------------------------- Warnings Summary: 1 1 ../drivers/tty/serial/8250/8250_fintek.c:34:0: warning: "IRQ_MODE" redefined =============================================================================== Detailed per-defconfig build reports below: ------------------------------------------------------------------------------- arm-allmodconfig : PASS, 0 errors, 1 warnings, 0 section mismatches Warnings: ../drivers/tty/serial/8250/8250_fintek.c:34:0: warning: "IRQ_MODE" redefined ------------------------------------------------------------------------------- Passed with no errors, warnings or mismatches: arm64-allnoconfig arm64-allmodconfig arm-multi_v5_defconfig arm-multi_v7_defconfig x86_64-defconfig arm-allnoconfig x86_64-allnoconfig arm64-defconfig close failed in file object destructor: sys.excepthook is missing lost sys.stderr

9 years, 1 month

master build: 2 failures 1 warnings (v4.7-11470-gd52bd54)

by Build bot for Mark Brown

Tree/Branch: master Git describe: v4.7-11470-gd52bd54 Commit: d52bd54db8 Merge branch 'akpm' (patches from Andrew) Build Time: 151 min 7 sec Passed: 7 / 9 ( 77.78 %) Failed: 2 / 9 ( 22.22 %) Errors: 0 Warnings: 1 Section Mismatches: 0 Failed defconfigs: arm-allmodconfig Errors: ------------------------------------------------------------------------------- defconfigs with issues (other than build errors): 1 warnings 0 mismatches : arm-allmodconfig ------------------------------------------------------------------------------- Warnings Summary: 1 1 ../drivers/tty/serial/8250/8250_fintek.c:34:0: warning: "IRQ_MODE" redefined =============================================================================== Detailed per-defconfig build reports below: ------------------------------------------------------------------------------- arm-allmodconfig : FAIL, 0 errors, 1 warnings, 0 section mismatches Warnings: ../drivers/tty/serial/8250/8250_fintek.c:34:0: warning: "IRQ_MODE" redefined ------------------------------------------------------------------------------- Passed with no errors, warnings or mismatches: arm64-allnoconfig arm64-allmodconfig arm-multi_v5_defconfig arm-multi_v7_defconfig x86_64-defconfig arm-allnoconfig x86_64-allnoconfig arm64-defconfig close failed in file object destructor: sys.excepthook is missing lost sys.stderr

9 years, 1 month

master build: 2 failures 1 warnings (v4.7-11313-gc8d0267)

by Build bot for Mark Brown

Tree/Branch: master Git describe: v4.7-11313-gc8d0267 Commit: c8d0267efd Merge tag 'pci-v4.8-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci Build Time: 80 min 6 sec Passed: 7 / 9 ( 77.78 %) Failed: 2 / 9 ( 22.22 %) Errors: 0 Warnings: 1 Section Mismatches: 0 Failed defconfigs: arm-allmodconfig Errors: ------------------------------------------------------------------------------- defconfigs with issues (other than build errors): 1 warnings 0 mismatches : arm-allmodconfig ------------------------------------------------------------------------------- Warnings Summary: 1 1 ../drivers/tty/serial/8250/8250_fintek.c:34:0: warning: "IRQ_MODE" redefined =============================================================================== Detailed per-defconfig build reports below: ------------------------------------------------------------------------------- arm-allmodconfig : FAIL, 0 errors, 1 warnings, 0 section mismatches Warnings: ../drivers/tty/serial/8250/8250_fintek.c:34:0: warning: "IRQ_MODE" redefined ------------------------------------------------------------------------------- Passed with no errors, warnings or mismatches: arm64-allnoconfig arm64-allmodconfig arm-multi_v5_defconfig arm-multi_v7_defconfig x86_64-defconfig arm-allnoconfig x86_64-allnoconfig arm64-defconfig close failed in file object destructor: sys.excepthook is missing lost sys.stderr

9 years, 1 month

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

linaro-kernel