Re: 2.6.37-rc7: Regression: b43: crashes in hwrng_register()

[Mario 'BitKoenig' Holbe]

On Thu, Dec 30, 2010 at 06:46:31PM -0600, Larry Finger wrote:
> On 12/30/2010 06:37 PM, Herbert Xu wrote:
> > My suspicion is that VIA's xstore is writing more than 4 bytes as
> > the list pointer happens to lie immediately after rng->priv which
> > is where xstore is writing to.
> > 
> > Harald, do you know whether this is documented or is this a known
> > errata item?
> 
> The following patch should be able to test if xstore is overwriting the list
> pointer.

Confirmed. No crashes with the junk buffer in action.
I applied both patches (dump_stack() in hwrng_register() and junk[]
after priv data) to vanilla 2.6.37-rc7 and tested both: via-rng and my
via+rng2 as well as via-rng and b43-rng - no crashes. The (previously
also crashing) `cat rng_available' does survive as well:

$ cat /sys/devices/virtual/misc/hw_random/rng_available
via b43_phy0 via2 
$ 

Attached 2 dmesg excerpts.


regards & g'nite
   Mario
-- 
Tower: "Say fuelstate." Pilot: "Fuelstate."
Tower: "Say again." Pilot: "Again."
Tower: "Arghl, give me your fuel!" Pilot: "Sorry, need it by myself..."
[   11.606134] VIA RNG detected
[   11.606139] Calling hwrng_register
[   11.606145] Pid: 752, comm: modprobe Not tainted 2.6.37-rc7-self #1
[   11.606149] Call Trace:
[   11.606159]  [<f90c33ac>] ? hwrng_register+0x2c/0x14d [rng_core]
[   11.606167]  [<f90d0023>] ? mod_init+0x23/0x3b [via_rng]
[   11.606176]  [<c1003069>] ? do_one_initcall+0x68/0x10f
[   11.606186]  [<c105f0d3>] ? sys_init_module+0xca5/0xe36
[   11.606214]  [<c1008b1f>] ? sysenter_do_call+0x12/0x28
...
[   92.687121] VIA RNG detected
[   92.687126] Calling hwrng_register
[   92.687132] Pid: 2698, comm: modprobe Not tainted 2.6.37-rc7-self #1
[   92.687136] Call Trace:
[   92.687152]  [<f90c33ac>] ? hwrng_register+0x2c/0x14d [rng_core]
[   92.687161]  [<f8274023>] ? mod_init+0x23/0x3b [via_rng2]
[   92.687171]  [<c1003069>] ? do_one_initcall+0x68/0x10f
[   92.687181]  [<c105f0d3>] ? sys_init_module+0xca5/0xe36
[   92.687227]  [<c1008b1f>] ? sysenter_do_call+0x12/0x28
[   11.686811] VIA RNG detected
[   11.686816] Calling hwrng_register
[   11.686822] Pid: 807, comm: modprobe Not tainted 2.6.37-rc7-self #1
[   11.686826] Call Trace:
[   11.686839]  [<f8fb23ac>] ? hwrng_register+0x2c/0x14d [rng_core]
[   11.686847]  [<f923f023>] ? mod_init+0x23/0x3b [via_rng]
[   11.686856]  [<c1003069>] ? do_one_initcall+0x68/0x10f
[   11.686867]  [<c105f0d3>] ? sys_init_module+0xca5/0xe36
[   11.686897]  [<c1008b1f>] ? sysenter_do_call+0x12/0x28
...
[   29.964239] b43-pci-bridge 0000:02:00.0: PCI: Disallowing DAC for device
[   29.964251] b43-phy0: DMA mask fallback from 64-bit to 32-bit
[   29.984626] Calling hwrng_register
[   29.984640] Pid: 1550, comm: NetworkManager Not tainted 2.6.37-rc7-self #1
[   29.984648] Call Trace:
[   29.984688]  [<f8fb23ac>] ? hwrng_register+0x2c/0x14d [rng_core]
[   29.984729]  [<f8ffe879>] ? b43_wireless_core_init+0xd12/0xddf [b43]
[   29.984759]  [<f8ffed73>] ? b43_op_start+0xf8/0x142 [b43]
[   29.984796]  [<f8d463da>] ? cfg80211_netdev_notifier_call+0x342/0x355 [cfg80211]
[   29.984853]  [<f8f1a889>] ? ieee80211_do_open+0xed/0x45f [mac80211]
[   29.984886]  [<f8f19e7a>] ? ieee80211_check_concurrent_iface+0x1c/0x135 [mac80211]
[   29.984908]  [<c1203247>] ? __dev_open+0x7d/0xa7
[   29.984922]  [<c1201c10>] ? __dev_change_flags+0x9a/0x10d
[   29.984934]  [<c120319f>] ? dev_change_flags+0x10/0x3b
[   29.984949]  [<c120d207>] ? do_setlink+0x23e/0x532
[   29.984965]  [<c120d5cb>] ? rtnl_setlink+0xd0/0xe1
[   29.984986]  [<c114f000>] ? clear_user+0x2b/0x43
[   29.984997]  [<c120d4fb>] ? rtnl_setlink+0x0/0xe1
[   29.985008]  [<c120cd32>] ? rtnetlink_rcv_msg+0x186/0x19c
[   29.985020]  [<c120cbac>] ? rtnetlink_rcv_msg+0x0/0x19c
[   29.985034]  [<c121bda8>] ? netlink_rcv_skb+0x2d/0x72
[   29.985046]  [<c120cba6>] ? rtnetlink_rcv+0x18/0x1e
[   29.985056]  [<c121bbfc>] ? netlink_unicast+0xba/0x10e
[   29.985068]  [<c121c700>] ? netlink_sendmsg+0x23d/0x256
[   29.985082]  [<c11f53a6>] ? __sock_sendmsg+0x48/0x4e
[   29.985093]  [<c11f560f>] ? sock_sendmsg+0x78/0x8f
[   29.985105]  [<c11f560f>] ? sock_sendmsg+0x78/0x8f
[   29.985119]  [<c10cf5dd>] ? d_kill+0x38/0x3d
[   29.985137]  [<c11fd48c>] ? verify_iovec+0x3d/0x79
[   29.985147]  [<c11f5e0d>] ? sys_sendmsg+0x15f/0x1c1
[   29.985159]  [<c11f5a44>] ? sockfd_lookup_light+0x13/0x3f
[   29.985170]  [<c11f60a5>] ? sys_sendto+0xfd/0x121
[   29.985182]  [<c11f996b>] ? sk_prot_alloc+0x62/0xd6
[   29.985195]  [<c10079ee>] ? __switch_to+0x6f/0xe2
[   29.985213]  [<c129ced6>] ? schedule+0x579/0x5b6
[   29.985225]  [<c11f5ca3>] ? sys_recvmsg+0x3c/0x47
[   29.985236]  [<c11f707d>] ? sys_socketcall+0x17f/0x1cb
[   29.985249]  [<c1008b1f>] ? sysenter_do_call+0x12/0x28
[   29.987285] ADDRCONF(NETDEV_UP): wlan0: link is not ready
...
[   99.003298] VIA RNG detected
[   99.003303] Calling hwrng_register
[   99.003309] Pid: 2797, comm: modprobe Not tainted 2.6.37-rc7-self #1
[   99.003313] Call Trace:
[   99.003332]  [<f8fb23ac>] ? hwrng_register+0x2c/0x14d [rng_core]
[   99.003341]  [<f8281023>] ? mod_init+0x23/0x3b [via_rng2]
[   99.003350]  [<c1003069>] ? do_one_initcall+0x68/0x10f
[   99.003360]  [<c105f0d3>] ? sys_init_module+0xca5/0xe36
[   99.003403]  [<c1008b1f>] ? sysenter_do_call+0x12/0x28

Attachment: signature.asc
Description: Digital signature