Re: crash by cdc_acm driver in kernels 4.8-rc1/5

[BjÃrn Mork]

Wim Osterholt <wim@xxxxxxxxxxxxxx> writes:

> On Mon, Nov 21, 2016 at 02:19:32PM +0100, Oliver Neukum wrote:
>
>> I don't understand it, bit please test the attached patch
>> with dynamic debugging for cdc-acm and the kernel log level
>> at maximum.
>
>> diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
>> index 6895f9e..f03b5db 100644
>> --- a/drivers/usb/class/cdc-acm.c
>> +++ b/drivers/usb/class/cdc-acm.c
>> @@ -1188,6 +1188,12 @@ static int acm_probe(struct usb_interface *intf,
>>  
>>  	cdc_parse_cdc_header(&h, intf, buffer, buflen);
>>  	union_header = h.usb_cdc_union_desc;
>> +
>> +	dev_dbg(&intf->dev, "Parsed device header\n");
>> +	dev_dbg(&intf->dev, "Union descriptor %p\n", h.usb_cdc_union_desc);
>> +	dev_dbg(&intf->dev, "ACM descriptor %p\n", h.usb_cdc_acm_descriptor);
>> +	dev_dbg(&intf->dev, "Country descriptor %p\n", h.usb_cdc_country_functional_desc);
>> +
>>  	cmgmd = h.usb_cdc_call_mgmt_descriptor;
>>  	if (cmgmd)
>>  		call_intf_num = cmgmd->bDataInterface;
>
>
> On kernel 4.8.8  this crashes hard and produces over a serial link:

Huh?  That device shouldn't ever enter that code path AFAICS.
Unless.... you wouldn't happen to add a dynamic entry for this device,
would you?  What's the output of

 cat /sys/bus/usb/drivers/cdc_acm/new_id

?

We should probably survive it, but I think the current acm_probe() is
going to barf hard on the last data interface, if probed without the
default NO_UNION_NORMAL quirk.  cdc_parse_cdc_header() will happily
parse all the functional descriptors, including the union pointing to
interfaces 0 and 1.  I might be missing it, but I cannot see any sanity
check verifying that the currently probed interface is actually part of
the set of interfaces pointed to by the union.  There is a sanity check
for the availability of the data interface, but there is none for the
control interface (the assumption of course that that's the interface
we're probing).

I think we need a bit more sanity checking of the union.  This is likely
a generic problem for any CDC driver, so it is worth considering adding
a shared function for that.

And all this fails to explain anything if you didn't add the device
dynamically, of course...



BjÃrn