lkml.org 
[lkml]   [2006]   [Jan]   [22]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Subjectuevent buffer overflow in input layer
    From
    Date
    Current -git as of today does this on an x86 box with a logitech USB
    keyboard:

    (the $$$ is debug stuff I added to print_modalias(), size is the size
    passed in and "Total len" is the value of "len" before returning). We
    end up overflowing, thus we pass a negative size to snprintf which
    causes the WARN_ON. Bumping the uevent buffer size in lib/kobject_uevent.c
    from 1024 to 2048 seems to fix the oops and /dev/input/mice is now properly
    created and works (it doesn't without the fix, X fails and we end up back
    in console with a dead keyboard).

    I'm not sure it's the correct solution as I'm not too familiar with the
    uevent code though, so I'll let you guys decide on the proper approach.

    $$$ print_modalias, size: 652
    input:b0003v046DpC505e1711-Total len: 167
    input: Logitech USB Receiver as /class/input/input0
    input: USB HID v1.10 Keyboard [Logitech USB Receiver] on usb-0000:00:1d.7-1.1
    $$$ print_modalias, size: 610
    input:b0003v046DpC505e1711-Badness in vsnprintf at lib/vsprintf.c:279
    [<c01ff955>] vsnprintf+0x625/0x630
    [<c01ff689>] vsnprintf+0x359/0x630
    [<c01ff9cb>] snprintf+0x2b/0x30
    [<c02a9214>] print_modalias_bits+0x94/0xb0
    [<c02a9301>] print_modalias+0xd1/0x210
    [<c02a9a8e>] input_dev_uevent+0x23e/0x4a0
    [<c02a9850>] input_dev_uevent+0x0/0x4a0
    [<c026ade4>] class_uevent+0x194/0x220
    [<c026ac50>] class_uevent+0x0/0x220
    [<c01fcc58>] kobject_uevent+0x1e8/0x4b0
    [<c026a989>] class_device_add+0x199/0x320
    [<c01ff9cb>] snprintf+0x2b/0x30
    [<c02aad7c>] input_register_device+0x11c/0x2e0
    [<c02a7288>] hidinput_connect+0x298/0x1cb0
    [<c02a4aa6>] hid_probe+0x9d6/0xeb0
    [<c032ae9a>] __mutex_unlock_slowpath+0x5a/0x170
    [<c019de26>] sysfs_create_link+0xe6/0x150
    [<c028ee9f>] usb_probe_interface+0x6f/0xb0
    [<c0269764>] driver_probe_device+0x54/0xf0
    [<c0269880>] __driver_attach+0x0/0x70
    [<c02698e7>] __driver_attach+0x67/0x70
    [<c0268b3d>] bus_for_each_dev+0x5d/0x80
    [<c02695e5>] driver_attach+0x25/0x30
    [<c0269880>] __driver_attach+0x0/0x70
    [<c0268f0c>] bus_add_driver+0x8c/0x180
    [<c0269cdb>] driver_register+0x4b/0x90
    [<c028ecf0>] usb_register_driver+0x60/0xf0
    [<c03f15a5>] hiddev_init+0x15/0x20
    [<c03f1558>] hid_init+0x28/0x60
    [<c010030e>] init+0x8e/0x220
    [<c0100280>] init+0x0/0x220
    [<c0101005>] kernel_thread_helper+0x5/0x10
    Total len: 613
    input: Logitech USB Receiver as /class/input/input1
    input: USB HID v1.10 Mouse [Logitech USB Receiver] on usb-0000:00:1d.7-1.1
    $$$ print_modalias, size: 688
    input:b0003v045Ep0084e0000-Total len: 60
    input: Microsoft Basic Optical Mouse as /class/input/input2
    input: USB HID v1.10 Mouse [Microsoft Basic Optical Mouse] on usb-0000:00:1d.7-1.2
    usbcore: registered new driver usbhid
    drivers/usb/input/hid-core.c: v2.6:USB HID core driver
    mice: PS/2 mouse device common for all mice
    MC: drivers/edac/edac_mc.c version edac_mc Ver: 2.0.0 Jan 22 2006
    NET: Registered protocol family 2
    IP route cache hash table entries: 65536 (order: 6, 262144 bytes)
    TCP established hash table entries: 262144 (order: 8, 1048576 bytes)
    TCP bind hash table entries: 65536 (order: 6, 262144 bytes)
    TCP: Hash tables configured (established 262144 bind 65536)
    TCP reno registered
    TCP bic registered
    NET: Registered protocol family 1
    NET: Registered protocol family 17
    NET: Registered protocol family 8
    NET: Registered protocol family 20
    Using IPI Shortcut mode
    ACPI wakeup devices:
    PCI0 PEX0 PEX1 PEX2 PEX3 HUB0 UAR1 USB0 USB1 USB2 USB3 USBE AC97 AZAL
    ACPI: (supports S0 S1 S3 S4 S5)
    kjournald starting. Commit interval 5 seconds
    EXT3-fs: mounted filesystem with ordered data mode.
    VFS: Mounted root (ext3 filesystem) readonly.
    Freeing unused kernel memory: 188k freed
    $$$ print_modalias, size: 652
    input:b0003v046DpC505e1711-Total len: 167
    $$$ print_modalias, size: 610
    input:b0003v046DpC505e1711-Total len: 613
    $$$ print_modalias, size: 688
    input:b0003v045Ep0084e0000-Total len: 60
    Real Time Clock Driver v1.12ac
    hw_random: RNG not detected
    Linux agpgart interface v0.101 (c) Dave Jones
    agpgart: Detected an Intel 915G Chipset.
    agpgart: AGP aperture is 256M @ 0x0
    Uniform Multi-Platform E-IDE driver Revision: 7.00alpha2
    ide: Assuming 33MHz system bus speed for PIO modes; override with idebus=xx
    $$$ print_modalias, size: 779
    input:b0010v001Fp0001e0100-Total len: 45
    input: PC Speaker as /class/input/input3
    ACPI: PCI Interrupt 0000:02:00.0[A] -> GSI 16 (level, low) -> IRQ 169
    PCI: Setting latency timer of device 0000:02:00.0 to 64
    sky2 v0.13 addr 0xd8020000 irq 169 Yukon-EC (0xb6) rev 1
    sky2 eth0: addr 00:30:1b:b7:61:d8
    ICH6: IDE controller at PCI slot 0000:00:1f.1
    ACPI: PCI Interrupt 0000:00:1f.1[A] -> GSI 18 (level, low) -> IRQ 233
    ICH6: chipset revision 3
    ICH6: not 100% native mode: will probe irqs later
    ide0: BM-DMA at 0xf000-0xf007, BIOS settings: hda:DMA, hdb:pio
    ide1: BM-DMA at 0xf008-0xf00f, BIOS settings: hdc:pio, hdd:pio
    Probing IDE interface ide0...
    Initializing USB Mass Storage driver...
    scsi4 : SCSI emulation for USB Mass Storage devices
    usbcore: registered new driver usb-storage
    USB Mass Storage support registered.
    usb-storage: device found at 3
    usb-storage: waiting for device to settle before scanning
    ieee1394: Initialized config rom entry `ip1394'
    8139too Fast Ethernet driver 0.9.27
    hda: PIONEER DVD-RW DVR-109, ATAPI CD/DVD-ROM drive
    ide0 at 0x1f0-0x1f7,0x3f6 on irq 14
    Probing IDE interface ide1...
    ACPI: PCI Interrupt 0000:00:1b.0[A] -> GSI 16 (level, low) -> IRQ 169
    PCI: Setting latency timer of device 0000:00:1b.0 to 64
    hda_codec: Unknown model for ALC880, trying auto-probe from BIOS...
    hda_codec: Cannot set up configuration from BIOS. Using 3-stack mode...
    ACPI: PCI Interrupt 0000:04:0a.0[A] -> GSI 18 (level, low) -> IRQ 233
    PCI: Via IRQ fixup for 0000:04:0a.0, from 5 to 9
    ohci1394: fw-host0: OHCI-1394 1.0 (PCI): IRQ=[233] MMIO=[d8101000-d81017ff] Max Packet=[2048] IR/IT contexts=[4/8]
    ACPI: PCI Interrupt 0000:04:09.0[A] -> GSI 17 (level, low) -> IRQ 177
    eth1: RealTek RTL8139 at 0xd000, 00:40:95:0b:6c:2b, IRQ 177
    eth1: Identified 8139 chip type 'RTL-8100B/8139D'
    8139cp: 10/100 PCI Ethernet driver v1.2 (Mar 22, 2004)
    hda: ATAPI 40X DVD-ROM DVD-R CD-R/RW drive, 2000kB Cache, UDMA(66)
    Uniform CD-ROM driver Revision: 3.20
    ieee1394: Host added: ID:BUS[0-00:1023] GUID[00301bb70000623c]
    eth1394: eth2: IEEE-1394 IPv4 over 1394 Ethernet (fw-host0)
    Adding 3068372k swap on /dev/sda6. Priority:-1 extents:1 across:3068372k
    EXT3 FS on sda7, internal journal
    Vendor: USB2.0 Model: CF CardReader Rev: 9144
    Type: Direct-Access ANSI SCSI revision: 00
    sd 4:0:0:0: Attached scsi removable disk sdb
    Vendor: USB2.0 Model: CBO CardReader Rev: 9144
    Type: Direct-Access ANSI SCSI revision: 00
    sd 4:0:0:1: Attached scsi removable disk sdc
    usb-storage: device scan complete
    Probing IDE interface ide1...
    ieee1394: sbp2: Driver forced to serialize I/O (serialize_io=1)
    ieee1394: sbp2: Try serialize_io=0 for better performance
    kjournald starting. Commit interval 5 seconds
    EXT3 FS on sda1, internal journal
    EXT3-fs: mounted filesystem with ordered data mode.
    kjournald starting. Commit interval 5 seconds
    EXT3 FS on sda5, internal journal
    EXT3-fs: mounted filesystem with ordered data mode.
    hw_random: RNG not detected
    sky2 eth0: enabling interface
    ACPI: Power Button (FF) [PWRF]
    ACPI: Power Button (CM) [PWRB]
    ACPI: Fan [FAN] (on)
    ACPI: Thermal Zone [THRM] (45 C)
    sky2 eth0: Link is up at 100 Mbps, full duplex, flow control both


    -
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to majordomo@vger.kernel.org
    More majordomo info at http://vger.kernel.org/majordomo-info.html
    Please read the FAQ at http://www.tux.org/lkml/

    \
     
     \ /
      Last update: 2006-01-23 00:46    [W:0.032 / U:30.260 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site