Share

Linux Infrared Remote Control

Tracker: Patches

5 NULL dereference - ID: 2890017
Last Update: Settings changed ( lirc )

When rmmod lirc_igorplug, or when re-setting the USB bus, I get this:

Oct 31 16:02:11 rk lircd-0.8.6[3237]: error reading from /dev/lirc0
Oct 31 16:02:11 rk lircd-0.8.6[3237]: No such device
Oct 31 16:02:11 rk kernel: [ 844.650840] lirc_igorplugusb[2]: usb remote
disconnected
Oct 31 16:02:11 rk kernel: [ 844.651569] BUG: unable to handle kernel NULL
pointer dereference at 00000018
Oct 31 16:02:11 rk kernel: [ 844.651579] IP: [<f84180db>]
usb_remote_disconnect+0x8b/0x120 [lirc_igorplugusb]
Oct 31 16:02:11 rk kernel: [ 844.651594] *pde = 89e55067
Oct 31 16:02:11 rk kernel: [ 844.651600] Oops: 0000 [#1] SMP
Oct 31 16:02:11 rk kernel: [ 844.651607] last sysfs file:
/sys/devices/pci0000:00/0000:00:18.3/temp3_input
Oct 31 16:02:11 rk kernel: [ 844.651613] Modules linked in: sha256_generic
aes_i586 aes_generic cbc binfmt_misc ppdev lp parport capifs nvidia(P)
iptable_filter ip_tables x_tables lirc_igorplugusb lirc_dev pcspkr
snd_intel8x0 snd_ac97_codec ac97_bus snd_pcm_oss snd_mixer_oss snd_pcm
snd_seq_dummy snd_seq_oss snd_seq_midi snd_rawmidi snd_seq_midi_event
dm_crypt snd_seq snd_timer yenta_socket snd_seq_device rsrc_nonstatic snd
pcmcia_core soundcore snd_page_alloc agpgart i2c_nforce2 k8temp raid10
raid456 raid6_pq async_xor async_memcpy async_tx xor raid1 raid0 multipath
linear reiserfs usbhid usb_storage forcedeth
Oct 31 16:02:11 rk kernel: [ 844.651697]
Oct 31 16:02:11 rk kernel: [ 844.651706] Pid: 4795, comm: resetusb
Tainted: P (2.6.31-13-generic #45-Ubuntu)
Oct 31 16:02:11 rk kernel: [ 844.651713] EIP: 0060:[<f84180db>] EFLAGS:
00010282 CPU: 1
Oct 31 16:02:11 rk kernel: [ 844.651722] EIP is at
usb_remote_disconnect+0x8b/0x120 [lirc_igorplugusb]
Oct 31 16:02:11 rk kernel: [ 844.651728] EAX: 00000000 EBX: f6be2a40 ECX:
ffffff7c EDX: 0201b000
Oct 31 16:02:11 rk kernel: [ 844.651733] ESI: c3cedc64 EDI: f6411360 EBP:
f2de9d70 ESP: f2de9d58
Oct 31 16:02:11 rk kernel: [ 844.651738] DS: 007b ES: 007b FS: 00d8 GS:
00e0 SS: 0068
Oct 31 16:02:11 rk kernel: [ 844.651745] Process resetusb (pid: 4795,
ti=f2de8000 task=f2d325b0 task.ti=f2de8000)
Oct 31 16:02:11 rk kernel: [ 844.651749] Stack:
Oct 31 16:02:11 rk kernel: [ 844.651752] f8418a81 f84188d0 00000002
c3f81c00 c3f81c1c f84192c0 f2de9d8c c0411019
Oct 31 16:02:11 rk kernel: [ 844.651766] <0> 00000000 c3cedc00 c3f81c1c
f84192f4 c3dac400 f2de9d9c c039ef4e c3f81c50
Oct 31 16:02:11 rk kernel: [ 844.651780] <0> c3f81c1c f2de9dac c039f060
c3f81c1c c3f81c00 f2de9dc0 c04110bf 00000000
Oct 31 16:02:11 rk kernel: [ 844.651795] Call Trace:
Oct 31 16:02:11 rk kernel: [ 844.651810] [<c0411019>] ?
usb_unbind_interface+0xe9/0x120
Oct 31 16:02:11 rk kernel: [ 844.651821] [<c039ef4e>] ?
__device_release_driver+0x3e/0x90
Oct 31 16:02:11 rk kernel: [ 844.651829] [<c039f060>] ?
device_release_driver+0x20/0x40
Oct 31 16:02:11 rk kernel: [ 844.651837] [<c04110bf>] ?
usb_driver_release_interface+0x6f/0x80
Oct 31 16:02:11 rk kernel: [ 844.651844] [<c0411153>] ?
usb_forced_unbind_intf+0x13/0x20
Oct 31 16:02:11 rk kernel: [ 844.651853] [<c040a419>] ?
usb_reset_device+0x89/0x160
Oct 31 16:02:11 rk kernel: [ 844.651863] [<c04175fb>] ?
usbdev_ioctl+0x3eb/0xa10
Oct 31 16:02:11 rk kernel: [ 844.651870] [<c0410b37>] ?
usb_autopm_do_device+0x67/0xf0
Oct 31 16:02:11 rk kernel: [ 844.651881] [<c056c907>] ?
unlock_kernel+0x27/0x30
Oct 31 16:02:11 rk kernel: [ 844.651889] [<c0417030>] ?
usbdev_open+0x80/0x260
Oct 31 16:02:11 rk kernel: [ 844.651897] [<c0414e00>] ?
match_devt+0x0/0x20
Oct 31 16:02:11 rk kernel: [ 844.651907] [<c01ee6ec>] ?
__link_path_walk+0x9bc/0xb90
Oct 31 16:02:11 rk kernel: [ 844.651915] [<c0138bb7>] ?
try_to_wake_up+0xf7/0x350
Oct 31 16:02:11 rk kernel: [ 844.651923] [<c01e6e4d>] ?
chrdev_open+0xcd/0x190
Oct 31 16:02:11 rk kernel: [ 844.651933] [<c01e20c7>] ?
__dentry_open+0x187/0x230
Oct 31 16:02:11 rk kernel: [ 844.651941] [<c01e2255>] ?
nameidata_to_filp+0x55/0x70
Oct 31 16:02:11 rk kernel: [ 844.651948] [<c01e6d80>] ?
chrdev_open+0x0/0x190
Oct 31 16:02:11 rk kernel: [ 844.651955] [<c01efd8a>] ?
do_filp_open+0x53a/0x890
Oct 31 16:02:11 rk kernel: [ 844.651964] [<c01244a8>] ?
default_spin_lock_flags+0x8/0x10
Oct 31 16:02:11 rk kernel: [ 844.651972] [<c01f1583>] ?
vfs_ioctl+0x73/0x90
Oct 31 16:02:11 rk kernel: [ 844.651979] [<c01f1851>] ?
do_vfs_ioctl+0x71/0x310
Oct 31 16:02:11 rk kernel: [ 844.651985] [<c01f1b4f>] ?
sys_ioctl+0x5f/0x80
Oct 31 16:02:11 rk kernel: [ 844.651993] [<c01e1ef9>] ?
sys_open+0x29/0x40
Oct 31 16:02:11 rk kernel: [ 844.652001] [<c010334c>] ?
syscall_call+0x7/0xb
Oct 31 16:02:11 rk kernel: [ 844.652005] Code: 24 00 00 00 00 8b 47 28 e8
e3 34 ff ff 8b 43 08 c7 44 24 04 d0 88 41 f8 89 44 24 08 c7 04 24 81 8a 41
f8 e8 6e 21 15 c8 8b 47 48 <8b> 40 18 85 c0 74 05 e8 49 0e d4 c7 8b 43 08
c7 44 24 04 95 8a
Oct 31 16:02:11 rk kernel: [ 844.652083] EIP: [<f84180db>]
usb_remote_disconnect+0x8b/0x120 [lirc_igorplugusb] SS:ESP 0068:f2de9d58
Oct 31 16:02:11 rk kernel: [ 844.652096] CR2: 0000000000000018
Oct 31 16:02:11 rk kernel: [ 844.652103] ---[ end trace 9cdc32879942d938
]---

This is caused by freeing stuff of a buffer structure - that happens to be
empty. The attached patch fixes this, additionally removes some log clutter
(return code 0 means no data, so no reason to put anything into the log;
and don't print buffer overrun, if it happens with your remote control
there's nothing to be done about it anyway).


RĂ¼diger kuhlmann ( tadu ) - 2009-10-31 17:03

5

Closed

None

Nobody/Anonymous

None

None

Public


Comment ( 1 )

Date: 2009-11-09 19:00
Sender: lircProject Admin

Patch adapted and applied. Thanks.

Christoph


Attached File ( 1 )

Filename Description Download
fix-NULL-dereference.diff fix NULL dereference Download

Changes ( 4 )

Field Old Value Date By
allow_comments 1 2009-11-09 19:00 lirc
close_date - 2009-11-09 19:00 lirc
status_id Open 2009-11-09 19:00 lirc
File Added 348998: fix-NULL-dereference.diff 2009-10-31 17:03 tadu