Skip to content

Powered hub, USB wifi dongle and Ethernet: issues correlation #168

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Closed
ghost opened this issue Dec 2, 2012 · 1 comment
Closed

Powered hub, USB wifi dongle and Ethernet: issues correlation #168

ghost opened this issue Dec 2, 2012 · 1 comment

Comments

@ghost
Copy link

ghost commented Dec 2, 2012

My configuration around end of October:
1 Raspberry Pi 256M (manuf. in UK)
1 Sitecom 7-port hub
1 Sitecom RTL8191S WLAN adapter (USB)
rpi kernel + rpi firmware + default kernel parameter
Raspberry powered with an USB cable coming from the hub

Problems with wifi: sometimes it would randomly be dead, rebooting or unplug/replug would work.
Problems with ethernet: did not use it

My configuration now - scenario 1:
1 Raspberry Pi 512M
1 Sitecom 7-port hub
1 Sitecom RTL8191S WLAN adapter (USB)
rpi kernel + rpi firmware + default kernel parameter
Raspberry powered with an USB cable coming from the hub

Problems with wifi: the RTL8191S correctly associates to AP but cannot communicate, furthermore its MAC address is all FF:FF:FF:FF:FF:FF
Problems with ethernet: will randomly disconnect, never coming back online, see relevant "grep smsc95xx /var/log/kern.log" pasted below.

My configuration now - scenario 2:
same hardware, tested with kernel command line parameter smsc95xx.turbo_mode=N

same problems

My configuration now - scenario 3:
same hardware
power the RPI with a 5.1V phone charger instead of through hub
put the wifi dongle directly connected to the RPI
hub completely detached from RPI

Wifi will get correct MAC address and connect successfully (RX/TX working, not only RX like before)
no ethernet issues so far (little testing done so far)

My configuration now - scenario 4:
same hardware
power the RPI with a 5.1V phone charger instead of through hub
put the wifi dongle on the hub

Wifi will get correct MAC address and connect successfully, but will also go back to the FF:FF:FF:FF:FF:FF dead mode after a while
no ethernet issues so far (little testing done so far)

Summary

The laptop HUB and RPI are taking power from the same power socket multiplier, thus this post claiming GND as guilt could be relevant:
http://www.raspberrypi.org/phpBB3/viewtopic.php?f=66&t=11971

Update

I have tested out that the 4 ports on the left half of my Sitecom 7-ports hub are all providing not enough power, leading to the wifi dongle issue.
The ethernet problem could be unrelated.

Can you please update the elinux.org wiki page with information about this Sitecom 7-ports hub art.no CN-061? It would be nice to spare the pain to other users.

Basically only the remaining 3 ports are providing enough power. Unfortunately I do not have a multimeter here to measure it.

Dec 2 15:53:34 raspberrypi kernel: [ 1.305619] usbcore: registered new interface driver smsc95xx
Dec 2 15:53:34 raspberrypi kernel: [ 3.013480] smsc95xx v1.0.4
Dec 2 15:53:34 raspberrypi kernel: [ 3.090294] smsc95xx 1-1.1:1.0: eth0: register 'smsc95xx' at usb-bcm2708_usb-1.1, smsc95xx USB 2.0 Ethernet, b8:27:eb:94:bd:f0
Dec 2 15:53:34 raspberrypi kernel: [ 30.062970] smsc95xx 1-1.1:1.0: eth0: link up, 100Mbps, full-duplex, lpa 0xCDE1
Dec 2 16:02:51 raspberrypi kernel: [ 535.944858] smsc95xx 1-1.1:1.0: eth0: Failed to read register index 0x00000114
Dec 2 16:02:56 raspberrypi kernel: [ 540.944854] smsc95xx 1-1.1:1.0: eth0: Failed to write register index 0x00000114
Dec 2 16:03:01 raspberrypi kernel: [ 545.944860] smsc95xx 1-1.1:1.0: eth0: Failed to read register index 0x00000114
Dec 2 16:03:06 raspberrypi kernel: [ 550.944864] smsc95xx 1-1.1:1.0: eth0: Failed to read register index 0x00000118
Dec 2 16:03:11 raspberrypi kernel: [ 555.944863] smsc95xx 1-1.1:1.0: eth0: Failed to read register index 0x00000114
Dec 2 16:03:16 raspberrypi kernel: [ 560.944863] smsc95xx 1-1.1:1.0: eth0: Failed to write register index 0x00000114
Dec 2 16:03:21 raspberrypi kernel: [ 565.944860] smsc95xx 1-1.1:1.0: eth0: Failed to read register index 0x00000114
Dec 2 16:03:26 raspberrypi kernel: [ 570.944860] smsc95xx 1-1.1:1.0: eth0: Failed to read register index 0x00000118
Dec 2 16:03:32 raspberrypi kernel: [ 577.044871] smsc95xx 1-1.1:1.0: eth0: Failed to read register index 0x00000114
Dec 2 16:03:37 raspberrypi kernel: [ 582.044866] smsc95xx 1-1.1:1.0: eth0: Failed to write register index 0x00000114
Dec 2 16:03:42 raspberrypi kernel: [ 587.044867] smsc95xx 1-1.1:1.0: eth0: Failed to read register index 0x00000114
Dec 2 16:03:47 raspberrypi kernel: [ 592.044867] smsc95xx 1-1.1:1.0: eth0: Failed to read register index 0x00000118
Dec 2 16:03:52 raspberrypi kernel: [ 597.044865] smsc95xx 1-1.1:1.0: eth0: Failed to read register index 0x00000114
Dec 2 16:03:57 raspberrypi kernel: [ 602.044869] smsc95xx 1-1.1:1.0: eth0: Failed to write register index 0x00000114
Dec 2 16:04:02 raspberrypi kernel: [ 607.044866] smsc95xx 1-1.1:1.0: eth0: Failed to read register index 0x00000114
Dec 2 16:04:07 raspberrypi kernel: [ 612.044869] smsc95xx 1-1.1:1.0: eth0: Failed to read register index 0x00000118
Dec 2 16:04:12 raspberrypi kernel: [ 617.214897] smsc95xx 1-1.1:1.0: eth0: Failed to write register index 0x00000014
Dec 2 16:04:12 raspberrypi kernel: [ 617.214929] smsc95xx 1-1.1:1.0: eth0: Failed to write HW_CFG_LRST_ bit in HW_CFG register, ret = -110
Dec 2 16:04:18 raspberrypi kernel: [ 623.214894] smsc95xx 1-1.1:1.0: eth0: Failed to write register index 0x00000014
Dec 2 16:04:18 raspberrypi kernel: [ 623.214926] smsc95xx 1-1.1:1.0: eth0: Failed to write HW_CFG_LRST_ bit in HW_CFG register, ret = -110
Dec 2 16:04:24 raspberrypi kernel: [ 629.214872] smsc95xx 1-1.1:1.0: eth0: Failed to write register index 0x00000014
Dec 2 16:04:24 raspberrypi kernel: [ 629.214903] smsc95xx 1-1.1:1.0: eth0: Failed to write HW_CFG_LRST_ bit in HW_CFG register, ret = -110
Dec 2 16:04:30 raspberrypi kernel: [ 635.214874] smsc95xx 1-1.1:1.0: eth0: Failed to write register index 0x00000014
Dec 2 16:04:30 raspberrypi kernel: [ 635.214904] smsc95xx 1-1.1:1.0: eth0: Failed to write HW_CFG_LRST_ bit in HW_CFG register, ret = -110
Dec 2 16:04:36 raspberrypi kernel: [ 641.214872] smsc95xx 1-1.1:1.0: eth0: Failed to write register index 0x00000014
Dec 2 16:04:36 raspberrypi kernel: [ 641.214915] smsc95xx 1-1.1:1.0: eth0: Failed to write HW_CFG_LRST_ bit in HW_CFG register, ret = -110
Dec 2 16:04:42 raspberrypi kernel: [ 647.214891] smsc95xx 1-1.1:1.0: eth0: Failed to write register index 0x00000014
Dec 2 16:04:42 raspberrypi kernel: [ 647.214923] smsc95xx 1-1.1:1.0: eth0: Failed to write HW_CFG_LRST_ bit in HW_CFG register, ret = -110
Dec 2 16:04:48 raspberrypi kernel: [ 653.214884] smsc95xx 1-1.1:1.0: eth0: Failed to write register index 0x00000014
Dec 2 16:04:48 raspberrypi kernel: [ 653.214915] smsc95xx 1-1.1:1.0: eth0: Failed to write HW_CFG_LRST_ bit in HW_CFG register, ret = -110
Dec 2 16:04:54 raspberrypi kernel: [ 659.214956] smsc95xx 1-1.1:1.0: eth0: Failed to write register index 0x00000014
Dec 2 16:04:54 raspberrypi kernel: [ 659.214987] smsc95xx 1-1.1:1.0: eth0: Failed to write HW_CFG_LRST_ bit in HW_CFG register, ret = -110
Dec 2 16:05:00 raspberrypi kernel: [ 665.214880] smsc95xx 1-1.1:1.0: eth0: Failed to write register index 0x00000014
Dec 2 16:05:00 raspberrypi kernel: [ 665.214910] smsc95xx 1-1.1:1.0: eth0: Failed to write HW_CFG_LRST_ bit in HW_CFG register, ret = -110
Dec 2 16:05:06 raspberrypi kernel: [ 671.214884] smsc95xx 1-1.1:1.0: eth0: Failed to write register index 0x00000014
Dec 2 16:05:06 raspberrypi kernel: [ 671.214915] smsc95xx 1-1.1:1.0: eth0: Failed to write HW_CFG_LRST_ bit in HW_CFG register, ret = -110
Dec 2 16:05:12 raspberrypi kernel: [ 677.214974] smsc95xx 1-1.1:1.0: eth0: Failed to write register index 0x00000014
Dec 2 16:05:12 raspberrypi kernel: [ 677.215005] smsc95xx 1-1.1:1.0: eth0: Failed to write HW_CFG_LRST_ bit in HW_CFG register, ret = -110
Dec 2 16:05:18 raspberrypi kernel: [ 683.214876] smsc95xx 1-1.1:1.0: eth0: Failed to write register index 0x00000014
Dec 2 16:05:18 raspberrypi kernel: [ 683.214907] smsc95xx 1-1.1:1.0: eth0: Failed to write HW_CFG_LRST_ bit in HW_CFG register, ret = -110
Dec 2 16:05:24 raspberrypi kernel: [ 689.214914] smsc95xx 1-1.1:1.0: eth0: Failed to write register index 0x00000014
Dec 2 16:05:24 raspberrypi kernel: [ 689.214946] smsc95xx 1-1.1:1.0: eth0: Failed to write HW_CFG_LRST_ bit in HW_CFG register, ret = -110
Dec 2 16:05:30 raspberrypi kernel: [ 695.214955] smsc95xx 1-1.1:1.0: eth0: Failed to write register index 0x00000014
Dec 2 16:05:30 raspberrypi kernel: [ 695.214986] smsc95xx 1-1.1:1.0: eth0: Failed to write HW_CFG_LRST_ bit in HW_CFG register, ret = -110
Dec 2 16:05:36 raspberrypi kernel: [ 701.214883] smsc95xx 1-1.1:1.0: eth0: Failed to write register index 0x00000014
Dec 2 16:05:36 raspberrypi kernel: [ 701.214914] smsc95xx 1-1.1:1.0: eth0: Failed to write HW_CFG_LRST_ bit in HW_CFG register, ret = -110
Dec 2 16:05:42 raspberrypi kernel: [ 707.214877] smsc95xx 1-1.1:1.0: eth0: Failed to write register index 0x00000014
Dec 2 16:05:42 raspberrypi kernel: [ 707.214908] smsc95xx 1-1.1:1.0: eth0: Failed to write HW_CFG_LRST_ bit in HW_CFG register, ret = -110
Dec 2 16:05:48 raspberrypi kernel: [ 713.214956] smsc95xx 1-1.1:1.0: eth0: Failed to write register index 0x00000014
Dec 2 16:05:48 raspberrypi kernel: [ 713.214986] smsc95xx 1-1.1:1.0: eth0: Failed to write HW_CFG_LRST_ bit in HW_CFG register, ret = -110
Dec 2 16:05:54 raspberrypi kernel: [ 719.214885] smsc95xx 1-1.1:1.0: eth0: Failed to write register index 0x00000014
Dec 2 16:05:54 raspberrypi kernel: [ 719.214915] smsc95xx 1-1.1:1.0: eth0: Failed to write HW_CFG_LRST_ bit in HW_CFG register, ret = -110
Dec 2 16:06:00 raspberrypi kernel: [ 725.214878] smsc95xx 1-1.1:1.0: eth0: Failed to write register index 0x00000014
Dec 2 16:06:00 raspberrypi kernel: [ 725.214910] smsc95xx 1-1.1:1.0: eth0: Failed to write HW_CFG_LRST_ bit in HW_CFG register, ret = -110
Dec 2 16:06:06 raspberrypi kernel: [ 731.214972] smsc95xx 1-1.1:1.0: eth0: Failed to write register index 0x00000014
Dec 2 16:06:06 raspberrypi kernel: [ 731.215004] smsc95xx 1-1.1:1.0: eth0: Failed to write HW_CFG_LRST_ bit in HW_CFG register, ret = -110
Dec 2 16:06:12 raspberrypi kernel: [ 737.214879] smsc95xx 1-1.1:1.0: eth0: Failed to write register index 0x00000014
Dec 2 16:06:12 raspberrypi kernel: [ 737.214911] smsc95xx 1-1.1:1.0: eth0: Failed to write HW_CFG_LRST_ bit in HW_CFG register, ret = -110
Dec 2 16:06:18 raspberrypi kernel: [ 743.215003] smsc95xx 1-1.1:1.0: eth0: Failed to write register index 0x00000014
Dec 2 16:06:18 raspberrypi kernel: [ 743.215033] smsc95xx 1-1.1:1.0: eth0: Failed to write HW_CFG_LRST_ bit in HW_CFG register, ret = -110
Dec 2 16:06:24 raspberrypi kernel: [ 749.214956] smsc95xx 1-1.1:1.0: eth0: Failed to write register index 0x00000014
Dec 2 16:06:24 raspberrypi kernel: [ 749.214987] smsc95xx 1-1.1:1.0: eth0: Failed to write HW_CFG_LRST_ bit in HW_CFG register, ret = -110
Dec 2 16:06:30 raspberrypi kernel: [ 755.214903] smsc95xx 1-1.1:1.0: eth0: Failed to write register index 0x00000014
Dec 2 16:06:30 raspberrypi kernel: [ 755.214936] smsc95xx 1-1.1:1.0: eth0: Failed to write HW_CFG_LRST_ bit in HW_CFG register, ret = -110
Dec 2 16:06:36 raspberrypi kernel: [ 761.214887] smsc95xx 1-1.1:1.0: eth0: Failed to write register index 0x00000014
Dec 2 16:06:36 raspberrypi kernel: [ 761.214919] smsc95xx 1-1.1:1.0: eth0: Failed to write HW_CFG_LRST_ bit in HW_CFG register, ret = -110
Dec 2 16:06:42 raspberrypi kernel: [ 767.214872] smsc95xx 1-1.1:1.0: eth0: Failed to write register index 0x00000014
Dec 2 16:06:42 raspberrypi kernel: [ 767.214903] smsc95xx 1-1.1:1.0: eth0: Failed to write HW_CFG_LRST_ bit in HW_CFG register, ret = -110
Dec 2 16:06:48 raspberrypi kernel: [ 773.214871] smsc95xx 1-1.1:1.0: eth0: Failed to write register index 0x00000014
Dec 2 16:06:48 raspberrypi kernel: [ 773.214902] smsc95xx 1-1.1:1.0: eth0: Failed to write HW_CFG_LRST_ bit in HW_CFG register, ret = -110
Dec 2 16:06:54 raspberrypi kernel: [ 779.214873] smsc95xx 1-1.1:1.0: eth0: Failed to write register index 0x00000014
Dec 2 16:06:54 raspberrypi kernel: [ 779.214904] smsc95xx 1-1.1:1.0: eth0: Failed to write HW_CFG_LRST_ bit in HW_CFG register, ret = -110
Dec 2 16:07:00 raspberrypi kernel: [ 785.214876] smsc95xx 1-1.1:1.0: eth0: Failed to write register index 0x00000014
Dec 2 16:07:00 raspberrypi kernel: [ 785.214907] smsc95xx 1-1.1:1.0: eth0: Failed to write HW_CFG_LRST_ bit in HW_CFG register, ret = -110
Dec 2 16:07:06 raspberrypi kernel: [ 791.214892] smsc95xx 1-1.1:1.0: eth0: Failed to write register index 0x00000014
Dec 2 16:07:06 raspberrypi kernel: [ 791.214923] smsc95xx 1-1.1:1.0: eth0: Failed to write HW_CFG_LRST_ bit in HW_CFG register, ret = -110
Dec 2 16:07:12 raspberrypi kernel: [ 797.214871] smsc95xx 1-1.1:1.0: eth0: Failed to write register index 0x00000014
Dec 2 16:07:12 raspberrypi kernel: [ 797.214903] smsc95xx 1-1.1:1.0: eth0: Failed to write HW_CFG_LRST_ bit in HW_CFG register, ret = -110
Dec 2 16:07:18 raspberrypi kernel: [ 803.214871] smsc95xx 1-1.1:1.0: eth0: Failed to write register index 0x00000014
Dec 2 16:07:18 raspberrypi kernel: [ 803.214902] smsc95xx 1-1.1:1.0: eth0: Failed to write HW_CFG_LRST_ bit in HW_CFG register, ret = -110
Dec 2 16:07:24 raspberrypi kernel: [ 809.214883] smsc95xx 1-1.1:1.0: eth0: Failed to write register index 0x00000014
Dec 2 16:07:24 raspberrypi kernel: [ 809.214914] smsc95xx 1-1.1:1.0: eth0: Failed to write HW_CFG_LRST_ bit in HW_CFG register, ret = -110
Dec 2 16:07:30 raspberrypi kernel: [ 815.214873] smsc95xx 1-1.1:1.0: eth0: Failed to write register index 0x00000014
Dec 2 16:07:30 raspberrypi kernel: [ 815.214904] smsc95xx 1-1.1:1.0: eth0: Failed to write HW_CFG_LRST_ bit in HW_CFG register, ret = -110
Dec 2 16:07:36 raspberrypi kernel: [ 821.214894] smsc95xx 1-1.1:1.0: eth0: Failed to write register index 0x00000014
Dec 2 16:07:36 raspberrypi kernel: [ 821.214926] smsc95xx 1-1.1:1.0: eth0: Failed to write HW_CFG_LRST_ bit in HW_CFG register, ret = -110
@doc doc mentioned this issue Dec 8, 2012
Closed
@ghollingworth
Copy link

Looks like this is not a linux issue

@ratherDashing ratherDashing mentioned this issue Feb 24, 2013
Closed
ssvb pushed a commit to ssvb/linux-rpi that referenced this issue Jun 4, 2013
hwmon: (lm70) fix checkpatch issues
56c24af 
fixed:
ERROR: spaces required around that '=' (ctx:VxV)
raspberrypi#60: FILE: lm70.c:60:
+	s16 raw=0;
 	       ^

ERROR: do not use assignment in if condition
raspberrypi#168: FILE: lm70.c:168:
+	if ((status = device_create_file(&spi->dev, &dev_attr_temp1_input))

Signed-off-by: Frans Meulenbroeks <[email protected]>
Signed-off-by: Guenter Roeck <[email protected]>
@velolala velolala mentioned this issue Sep 2, 2012
Closed
popcornmix pushed a commit that referenced this issue Oct 8, 2014
@ummakynes
netfilter: nft_hash: no need for rcu in the hash set destroy path
39f3901 
The sets are released from the rcu callback, after the rule is removed
from the chain list, which implies that nfnetlink cannot update the
hashes (thus, no resizing may occur) and no packets are walking on the
set anymore.

This resolves a lockdep splat in the nft_hash_destroy() path since the
nfnl mutex is not held there.

===============================
[ INFO: suspicious RCU usage. ]
3.16.0-rc2+ #168 Not tainted
-------------------------------
net/netfilter/nft_hash.c:362 suspicious rcu_dereference_protected() usage!

other info that might help us debug this:

rcu_scheduler_active = 1, debug_locks = 1
1 lock held by ksoftirqd/0/3:
 #0:  (rcu_callback){......}, at: [<ffffffff81096393>] rcu_process_callbacks+0x27e/0x4c7

stack backtrace:
CPU: 0 PID: 3 Comm: ksoftirqd/0 Not tainted 3.16.0-rc2+ #168
Hardware name: LENOVO 23259H1/23259H1, BIOS G2ET32WW (1.12 ) 05/30/2012
 0000000000000001 ffff88011769bb98 ffffffff8142c922 0000000000000006
 ffff880117694090 ffff88011769bbc8 ffffffff8107c3ff ffff8800cba52400
 ffff8800c476bea8 ffff8800c476bea8 ffff8800cba52400 ffff88011769bc08
Call Trace:
 [<ffffffff8142c922>] dump_stack+0x4e/0x68
 [<ffffffff8107c3ff>] lockdep_rcu_suspicious+0xfa/0x103
 [<ffffffffa079931e>] nft_hash_destroy+0x50/0x137 [nft_hash]
 [<ffffffffa078cd57>] nft_set_destroy+0x11/0x2a [nf_tables]

Signed-off-by: Pablo Neira Ayuso <[email protected]>
Acked-by: Thomas Graf <[email protected]>
anholt pushed a commit to anholt/linux that referenced this issue Apr 14, 2016
@akpm00 @sfrothwell
mm-compaction-direct-freepage-allocation-for-async-direct-compaction-…
7238cc7 
…checkpatch-fixes

ERROR: "foo * bar" should be "foo *bar"
raspberrypi#168: FILE: mm/internal.h:148:
+extern struct page * alloc_pages_zone(struct zone *zone, unsigned int order,

total: 1 errors, 0 warnings, 159 lines checked

./patches/mm-compaction-direct-freepage-allocation-for-async-direct-compaction.patch has style problems, please review.

NOTE: If any of the errors are false positives, please report
      them to the maintainer, see CHECKPATCH in MAINTAINERS.

Please run checkpatch prior to sending patches

Cc: Vlastimil Babka <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>
@blackarchon blackarchon mentioned this issue Jun 14, 2017
Closed
popcornmix pushed a commit that referenced this issue Apr 2, 2019
@gregkh
ipmi_si: fix use-after-free of resource->name
a8964a6 
commit 401e7e8 upstream.

When we excute the following commands, we got oops
rmmod ipmi_si
cat /proc/ioports

[ 1623.482380] Unable to handle kernel paging request at virtual address ffff00000901d478
[ 1623.482382] Mem abort info:
[ 1623.482383]   ESR = 0x96000007
[ 1623.482385]   Exception class = DABT (current EL), IL = 32 bits
[ 1623.482386]   SET = 0, FnV = 0
[ 1623.482387]   EA = 0, S1PTW = 0
[ 1623.482388] Data abort info:
[ 1623.482389]   ISV = 0, ISS = 0x00000007
[ 1623.482390]   CM = 0, WnR = 0
[ 1623.482393] swapper pgtable: 4k pages, 48-bit VAs, pgdp = 00000000d7d94a66
[ 1623.482395] [ffff00000901d478] pgd=000000dffbfff003, pud=000000dffbffe003, pmd=0000003f5d06e003, pte=0000000000000000
[ 1623.482399] Internal error: Oops: 96000007 [#1] SMP
[ 1623.487407] Modules linked in: ipmi_si(E) nls_utf8 isofs rpcrdma ib_iser ib_srpt target_core_mod ib_srp scsi_transport_srp ib_ipoib rdma_ucm ib_umad rdma_cm ib_cm dm_mirror dm_region_hash dm_log iw_cm dm_mod aes_ce_blk crypto_simd cryptd aes_ce_cipher ses ghash_ce sha2_ce enclosure sha256_arm64 sg sha1_ce hisi_sas_v2_hw hibmc_drm sbsa_gwdt hisi_sas_main ip_tables mlx5_ib ib_uverbs marvell ib_core mlx5_core ixgbe mdio hns_dsaf ipmi_devintf hns_enet_drv ipmi_msghandler hns_mdio [last unloaded: ipmi_si]
[ 1623.532410] CPU: 30 PID: 11438 Comm: cat Kdump: loaded Tainted: G            E     5.0.0-rc3+ #168
[ 1623.541498] Hardware name: Huawei TaiShan 2280 /BC11SPCD, BIOS 1.37 11/21/2017
[ 1623.548822] pstate: a0000005 (NzCv daif -PAN -UAO)
[ 1623.553684] pc : string+0x28/0x98
[ 1623.557040] lr : vsnprintf+0x368/0x5e8
[ 1623.560837] sp : ffff000013213a80
[ 1623.564191] x29: ffff000013213a80 x28: ffff00001138abb5
[ 1623.569577] x27: ffff000013213c18 x26: ffff805f67d06049
[ 1623.574963] x25: 0000000000000000 x24: ffff00001138abb5
[ 1623.580349] x23: 0000000000000fb7 x22: ffff0000117ed000
[ 1623.585734] x21: ffff000011188fd8 x20: ffff805f67d07000
[ 1623.591119] x19: ffff805f67d06061 x18: ffffffffffffffff
[ 1623.596505] x17: 0000000000000200 x16: 0000000000000000
[ 1623.601890] x15: ffff0000117ed748 x14: ffff805f67d07000
[ 1623.607276] x13: ffff805f67d0605e x12: 0000000000000000
[ 1623.612661] x11: 0000000000000000 x10: 0000000000000000
[ 1623.618046] x9 : 0000000000000000 x8 : 000000000000000f
[ 1623.623432] x7 : ffff805f67d06061 x6 : fffffffffffffffe
[ 1623.628817] x5 : 0000000000000012 x4 : ffff00000901d478
[ 1623.634203] x3 : ffff0a00ffffff04 x2 : ffff805f67d07000
[ 1623.639588] x1 : ffff805f67d07000 x0 : ffffffffffffffff
[ 1623.644974] Process cat (pid: 11438, stack limit = 0x000000008d4cbc10)
[ 1623.651592] Call trace:
[ 1623.654068]  string+0x28/0x98
[ 1623.657071]  vsnprintf+0x368/0x5e8
[ 1623.660517]  seq_vprintf+0x70/0x98
[ 1623.668009]  seq_printf+0x7c/0xa0
[ 1623.675530]  r_show+0xc8/0xf8
[ 1623.682558]  seq_read+0x330/0x440
[ 1623.689877]  proc_reg_read+0x78/0xd0
[ 1623.697346]  __vfs_read+0x60/0x1a0
[ 1623.704564]  vfs_read+0x94/0x150
[ 1623.711339]  ksys_read+0x6c/0xd8
[ 1623.717939]  __arm64_sys_read+0x24/0x30
[ 1623.725077]  el0_svc_common+0x120/0x148
[ 1623.732035]  el0_svc_handler+0x30/0x40
[ 1623.738757]  el0_svc+0x8/0xc
[ 1623.744520] Code: d1000406 aa0103e2 54000149 b4000080 (39400085)
[ 1623.753441] ---[ end trace f91b6a4937de9835 ]---
[ 1623.760871] Kernel panic - not syncing: Fatal exception
[ 1623.768935] SMP: stopping secondary CPUs
[ 1623.775718] Kernel Offset: disabled
[ 1623.781998] CPU features: 0x002,21006008
[ 1623.788777] Memory Limit: none
[ 1623.798329] Starting crashdump kernel...
[ 1623.805202] Bye!

If io_setup is called successful in try_smi_init() but try_smi_init()
goes out_err before calling ipmi_register_smi(), so ipmi_unregister_smi()
will not be called while removing module. It leads to the resource that
allocated in io_setup() can not be freed, but the name(DEVICE_NAME) of
resource is freed while removing the module. It causes use-after-free
when cat /proc/ioports.

Fix this by calling io_cleanup() while try_smi_init() goes to out_err.
and don't call io_cleanup() until io_setup() returns successful to avoid
warning prints.

Fixes: 93c303d ("ipmi_si: Clean up shutdown a bit")
Cc: [email protected]
Reported-by: NuoHan Qiao <[email protected]>
Suggested-by: Corey Minyard <[email protected]>
Signed-off-by: Yang Yingliang <[email protected]>
Signed-off-by: Corey Minyard <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
popcornmix pushed a commit that referenced this issue Apr 2, 2019
@gregkh
ipmi_si: fix use-after-free of resource->name
a441fda 
commit 401e7e8 upstream.

When we excute the following commands, we got oops
rmmod ipmi_si
cat /proc/ioports

[ 1623.482380] Unable to handle kernel paging request at virtual address ffff00000901d478
[ 1623.482382] Mem abort info:
[ 1623.482383]   ESR = 0x96000007
[ 1623.482385]   Exception class = DABT (current EL), IL = 32 bits
[ 1623.482386]   SET = 0, FnV = 0
[ 1623.482387]   EA = 0, S1PTW = 0
[ 1623.482388] Data abort info:
[ 1623.482389]   ISV = 0, ISS = 0x00000007
[ 1623.482390]   CM = 0, WnR = 0
[ 1623.482393] swapper pgtable: 4k pages, 48-bit VAs, pgdp = 00000000d7d94a66
[ 1623.482395] [ffff00000901d478] pgd=000000dffbfff003, pud=000000dffbffe003, pmd=0000003f5d06e003, pte=0000000000000000
[ 1623.482399] Internal error: Oops: 96000007 [#1] SMP
[ 1623.487407] Modules linked in: ipmi_si(E) nls_utf8 isofs rpcrdma ib_iser ib_srpt target_core_mod ib_srp scsi_transport_srp ib_ipoib rdma_ucm ib_umad rdma_cm ib_cm dm_mirror dm_region_hash dm_log iw_cm dm_mod aes_ce_blk crypto_simd cryptd aes_ce_cipher ses ghash_ce sha2_ce enclosure sha256_arm64 sg sha1_ce hisi_sas_v2_hw hibmc_drm sbsa_gwdt hisi_sas_main ip_tables mlx5_ib ib_uverbs marvell ib_core mlx5_core ixgbe mdio hns_dsaf ipmi_devintf hns_enet_drv ipmi_msghandler hns_mdio [last unloaded: ipmi_si]
[ 1623.532410] CPU: 30 PID: 11438 Comm: cat Kdump: loaded Tainted: G            E     5.0.0-rc3+ #168
[ 1623.541498] Hardware name: Huawei TaiShan 2280 /BC11SPCD, BIOS 1.37 11/21/2017
[ 1623.548822] pstate: a0000005 (NzCv daif -PAN -UAO)
[ 1623.553684] pc : string+0x28/0x98
[ 1623.557040] lr : vsnprintf+0x368/0x5e8
[ 1623.560837] sp : ffff000013213a80
[ 1623.564191] x29: ffff000013213a80 x28: ffff00001138abb5
[ 1623.569577] x27: ffff000013213c18 x26: ffff805f67d06049
[ 1623.574963] x25: 0000000000000000 x24: ffff00001138abb5
[ 1623.580349] x23: 0000000000000fb7 x22: ffff0000117ed000
[ 1623.585734] x21: ffff000011188fd8 x20: ffff805f67d07000
[ 1623.591119] x19: ffff805f67d06061 x18: ffffffffffffffff
[ 1623.596505] x17: 0000000000000200 x16: 0000000000000000
[ 1623.601890] x15: ffff0000117ed748 x14: ffff805f67d07000
[ 1623.607276] x13: ffff805f67d0605e x12: 0000000000000000
[ 1623.612661] x11: 0000000000000000 x10: 0000000000000000
[ 1623.618046] x9 : 0000000000000000 x8 : 000000000000000f
[ 1623.623432] x7 : ffff805f67d06061 x6 : fffffffffffffffe
[ 1623.628817] x5 : 0000000000000012 x4 : ffff00000901d478
[ 1623.634203] x3 : ffff0a00ffffff04 x2 : ffff805f67d07000
[ 1623.639588] x1 : ffff805f67d07000 x0 : ffffffffffffffff
[ 1623.644974] Process cat (pid: 11438, stack limit = 0x000000008d4cbc10)
[ 1623.651592] Call trace:
[ 1623.654068]  string+0x28/0x98
[ 1623.657071]  vsnprintf+0x368/0x5e8
[ 1623.660517]  seq_vprintf+0x70/0x98
[ 1623.668009]  seq_printf+0x7c/0xa0
[ 1623.675530]  r_show+0xc8/0xf8
[ 1623.682558]  seq_read+0x330/0x440
[ 1623.689877]  proc_reg_read+0x78/0xd0
[ 1623.697346]  __vfs_read+0x60/0x1a0
[ 1623.704564]  vfs_read+0x94/0x150
[ 1623.711339]  ksys_read+0x6c/0xd8
[ 1623.717939]  __arm64_sys_read+0x24/0x30
[ 1623.725077]  el0_svc_common+0x120/0x148
[ 1623.732035]  el0_svc_handler+0x30/0x40
[ 1623.738757]  el0_svc+0x8/0xc
[ 1623.744520] Code: d1000406 aa0103e2 54000149 b4000080 (39400085)
[ 1623.753441] ---[ end trace f91b6a4937de9835 ]---
[ 1623.760871] Kernel panic - not syncing: Fatal exception
[ 1623.768935] SMP: stopping secondary CPUs
[ 1623.775718] Kernel Offset: disabled
[ 1623.781998] CPU features: 0x002,21006008
[ 1623.788777] Memory Limit: none
[ 1623.798329] Starting crashdump kernel...
[ 1623.805202] Bye!

If io_setup is called successful in try_smi_init() but try_smi_init()
goes out_err before calling ipmi_register_smi(), so ipmi_unregister_smi()
will not be called while removing module. It leads to the resource that
allocated in io_setup() can not be freed, but the name(DEVICE_NAME) of
resource is freed while removing the module. It causes use-after-free
when cat /proc/ioports.

Fix this by calling io_cleanup() while try_smi_init() goes to out_err.
and don't call io_cleanup() until io_setup() returns successful to avoid
warning prints.

Fixes: 93c303d ("ipmi_si: Clean up shutdown a bit")
Cc: [email protected]
Reported-by: NuoHan Qiao <[email protected]>
Suggested-by: Corey Minyard <[email protected]>
Signed-off-by: Yang Yingliang <[email protected]>
Signed-off-by: Corey Minyard <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
1 participant
@ghollingworth