Bug 189279 - [Stratus RHEL4 U4 bug] unchecked error path in usb_alloc_dev can lead to an Oops.
[Stratus RHEL4 U4 bug] unchecked error path in usb_alloc_dev can lead to an O...
Product: Red Hat Enterprise Linux 4
Classification: Red Hat
Component: kernel (Show other bugs)
All Linux
medium Severity medium
: ---
: ---
Assigned To: Kimball Murray
Brian Brock
Depends On:
Blocks: 181409 184261
  Show dependency treegraph
Reported: 2006-04-18 15:08 EDT by Kimball Murray
Modified: 2007-11-30 17:07 EST (History)
2 users (show)

See Also:
Fixed In Version: RHSA-2006-0575
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2006-08-10 19:10:04 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)
This patch has been tested and applies to 2.6.9-34.17 (746 bytes, patch)
2006-04-18 15:08 EDT, Kimball Murray
no flags Details | Diff
Alternative fix (2.65 KB, patch)
2006-04-21 00:10 EDT, Pete Zaitcev
no flags Details | Diff

  None (edit)
Description Kimball Murray 2006-04-18 15:08:35 EDT
Description of problem:
usb_alloc_dev (drivers/usb/core/usb.c) calls dev->bus->op->allocate(...) without
checking the return value of that function.  That function seems to always point
to hcd_alloc_dev, which can fail for a variety of reasons, one if which is a low
memory condition.  But if that function does fail, udev->hcpriv will not have
been initialized, and we will Oops later on when that hcpriv field is dereferenced.

Version-Release number of selected component (if applicable):

How reproducible:
In our (Stratus) environment, we seem to step into this bug in almost 1 out of 3

Steps to Reproduce:
Generally, we've been hitting this by calling pci_remove for the root hub while
nearly at the same time disconnecting/connecting a USB keyboard to the hub.
Actual results:
kernel Oops from hcd_endpoint_disable().

Expected results:
better USB error handling.

Additional info:
This code path is not present upstream, as most of USB is re-written.  However,
for the existing RHEL4 code, we have put together a patch to test for the error
case to avoid the Oops, and tested it with success.  The patch is attached here.
Comment 1 Kimball Murray 2006-04-18 15:08:35 EDT
Created attachment 127941 [details]
This patch has been tested and applies to 2.6.9-34.17
Comment 3 Pete Zaitcev 2006-04-21 00:10:40 EDT
Created attachment 128073 [details]
Alternative fix
Comment 5 Kimball Murray 2006-04-25 09:39:47 EDT
Stratus has tested Pete's patch with positive results.
Comment 7 Jason Baron 2006-05-03 14:07:58 EDT
committed in stream U4 build 35. A test kernel with this patch is available from
Comment 10 Red Hat Bugzilla 2006-08-10 19:10:04 EDT
An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on the solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.


Note You need to log in before you can comment on or make changes to this bug.