Re: crash by cdc_acm driver in kernels 4.8-rc1/5

From: BjÃrn Mork
Date: Tue Nov 22 2016 - 13:09:57 EST

Wim Osterholt <wim@xxxxxxxxxxxxxx> writes:

> On Mon, Nov 21, 2016 at 02:19:32PM +0100, Oliver Neukum wrote:
>> I don't understand it, bit please test the attached patch
>> with dynamic debugging for cdc-acm and the kernel log level
>> at maximum.
>> diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
>> index 6895f9e..f03b5db 100644
>> --- a/drivers/usb/class/cdc-acm.c
>> +++ b/drivers/usb/class/cdc-acm.c
>> @@ -1188,6 +1188,12 @@ static int acm_probe(struct usb_interface *intf,
>> cdc_parse_cdc_header(&h, intf, buffer, buflen);
>> union_header = h.usb_cdc_union_desc;
>> +
>> + dev_dbg(&intf->dev, "Parsed device header\n");
>> + dev_dbg(&intf->dev, "Union descriptor %p\n", h.usb_cdc_union_desc);
>> + dev_dbg(&intf->dev, "ACM descriptor %p\n", h.usb_cdc_acm_descriptor);
>> + dev_dbg(&intf->dev, "Country descriptor %p\n", h.usb_cdc_country_functional_desc);
>> +
>> cmgmd = h.usb_cdc_call_mgmt_descriptor;
>> if (cmgmd)
>> call_intf_num = cmgmd->bDataInterface;
> On kernel 4.8.8 this crashes hard and produces over a serial link:

Huh? That device shouldn't ever enter that code path AFAICS.
Unless.... you wouldn't happen to add a dynamic entry for this device,
would you? What's the output of

cat /sys/bus/usb/drivers/cdc_acm/new_id


We should probably survive it, but I think the current acm_probe() is
going to barf hard on the last data interface, if probed without the
default NO_UNION_NORMAL quirk. cdc_parse_cdc_header() will happily
parse all the functional descriptors, including the union pointing to
interfaces 0 and 1. I might be missing it, but I cannot see any sanity
check verifying that the currently probed interface is actually part of
the set of interfaces pointed to by the union. There is a sanity check
for the availability of the data interface, but there is none for the
control interface (the assumption of course that that's the interface
we're probing).

I think we need a bit more sanity checking of the union. This is likely
a generic problem for any CDC driver, so it is worth considering adding
a shared function for that.

And all this fails to explain anything if you didn't add the device
dynamically, of course...