Re: Bug creating USB endpoints in 2.6.20.x (kernel bug 8198)

Alan Stern wrote:
> On Thu, 3 May 2007, Tejun Heo wrote:
> 
>> Hello, Alan Stern.
>>
>> Alan Stern wrote:
>>>> The endpoint directory shown in the oops report does not exist if I'm not thrashing the box with
>>>> winecfg. On Tejun Heo's suggestion, I put some debug code at the beginning of sysfs_release() to
>>>> print a stack-dump and the kobject's path if the attr->owner field contains 0x6b6b6b6b or
>>>> 0x5a5a5a5a poison:
>>>>
>>>> XXX debug trap owner=6b6b6b6b, path=/class/usb_endpoint/usbdev1.3_ep84
>>>> XXX debug stack-dump
>>>>  [<c018462a>] sysfs_release+0x70/0xa5
>>>>  [<c0151837>] __fput+0x96/0x13c
>>>>  [<c014f358>] filp_close+0x51/0x58
>>>>  [<c0150351>] sys_close+0x70/0xa7
>>>>  [<c0102bde>] sysenter_past_esp+0x5f/0x85
>>>>  [<c0270033>] unix_create1+0xa2/0xee
>>>>  =======================
>>> This clearly indicates that something has been deallocated too early (or 
>>> equivalently, used too late).
>> What has been filled with the 6b pattern here is struct attribute not
>> some sysfs internal object.
> 
> Are you sure?

That's what the debug code seems to tell us.

static int sysfs_release(struct inode * inode, struct file * filp)
{
	struct kobject * kobj = to_kobj(filp->f_path.dentry->d_parent);
	struct attribute * attr = to_attr(filp->f_path.dentry);
	struct module * owner = attr->owner;
	struct sysfs_buffer * buffer = filp->private_data;

        if ((unsigned long)owner >> 16 == 0x5a5a ||
            (unsigned long)owner >> 16 == 0x6b6b) {
                if (kobj != NULL) {
                        char *path = kobject_get_path(kobj, GFP_KERNEL);
                        printk("XXX debug trap owner=%p, path=%s\n", owner, path);
                        kfree(path);
                }
                printk("XXX debug stack-dump\n");
                dump_stack();
        }
	/* blah blah....*/
}

>>  Does USB allocate struct attribute
>> dynamically for any of its attributes?
> 
> No; it uses sysfs_create_group() with a static attribute group list.  I
> don't know why it doesn't call device_add_group() -- maybe it was written
> before that function existed.
> 
> You can see the code in drivers/usb/core/endpoint.c:usb_create_ep_files().

I see.  They're static alright.  That leaves us with sd pointing to
the wrong attr.  I'll take a look whether that's possible.

-- 
tejun

-------------------------------------------------------------------------
This SF.net email is sponsored by DB2 Express
Download DB2 Express C - the FREE version of DB2 express and take
control of your XML. No limits. Just data. Click to get it now.
http://sourceforge.net/powerbar/db2/
_______________________________________________
[email protected]
To unsubscribe, use the last form field at:
https://lists.sourceforge.net/lists/listinfo/linux-usb-devel