On Mon, Jun 07, 2004 at 03:03:39PM -0700, Greg KH wrote:
> ChangeSet 1.1848, 2004/06/07 14:05:59-07:00, [EMAIL PROTECTED]
> 
> [PATCH] USB: Fix problems with cyberjack usb-serial-module since kernel 2.6.2
> 
> > Send me a patch to back those changes out to fix your device and I'll
> > apply it.  If the author is around to realize this, that should wake
> > them up :)
> 
> Ok, here you are! :)
> Attached is a patch for linux-2.6.7-rc2. (though the patch hasn't changed
> since -rc1)

Thanks for fixing those issues in cyberjack.c.

JFYI: Matthias Bruestle is unable to work on the cyberjack driver
anymore due to time constraints, and REINER SCT has contracted me to do
their future linux usb driver work (which mostly happens in userspace).

If I'm going to maintain cyberjack.c in the kernel is yet unclear, but
meanwhile I'll try to make it work ;)

> Again a short description:
> (the patch removes most of the changes done in linux-2.6.2)
> 1. Removed the local buffer of cyberjack_write, because something goes wrong
> upon a write-request bigger than the buffer. Without this, a write-request
> stalls with error -3.
> 2. Removed some usb_clear_halt() lines. Without this, the device doesn't even
> open and returns -7.
> 
> It works for my cyberjack pinpad USB card reader on

By "it works" you mean what exactly? What did you specifically try?

I've applied that patch to a -rc2 tree and tested it on my system (i686,
UP, PIII 733MHz, VIA VT6202 USB Controller).

Result: 

When accessing the device using the reiner-sct CTAPI driver, the kernel
spits out the following messages (doesn't happen without the patch):

************************************************************
Debug: sleeping function called from invalid context at arch/i386/lib/usercopy.c:623
in_atomic():0, irqs_disabled():1
 [<c0116b48>] __might_sleep+0x98/0xa0
 [<c020d7d8>] copy_from_user+0x28/0x80
 [<f089d71e>] cyberjack_write+0x3ee/0x480 [cyberjack]
 [<f0895442>] serial_write+0x92/0xd0 [usbserial]
 [<c024238c>] normal_poll+0x11c/0x16b
 [<c0242244>] write_chan+0x204/0x230
 [<c0115dd0>] default_wake_function+0x0/0x20
 [<c0115dd0>] default_wake_function+0x0/0x20
 [<c023ce51>] tty_write+0x131/0x200
 [<c0242040>] write_chan+0x0/0x230
 [<c014f61d>] vfs_write+0xed/0x160
 [<c014f742>] sys_write+0x42/0x70
 [<c0105f4f>] syscall_call+0x7/0xb
************************************************************

Also, when trying to unload the module i get the follwoign error:

************************************************************
usbcore: deregistering driver cyberjack
drivers/usb/serial/usb-serial.c: USB Serial deregistering driver Reiner SCT Cyberjack 
USB card reader
cyberjack ttyUSB0: Reiner SCT Cyberjack USB card reader converter now disconnected 
from ttyUSB0
usbserial 1-2:1.0: device disconnected
Unable to handle kernel NULL pointer dereference at virtual address 00000084
 printing eip:
f0896e1e
*pde = 00000000
Oops: 0000 [#1]
Modules linked in: tun ipv6 acenic snd_ymfpci snd_ac97_codec snd_pcm snd_opl3_lib 
snd_timer snd_hwdep snd_page_alloc gameport snd_mpu401_uart snd_rawmidi snd_seq_device 
snd soundcore ohci1394 ieee1394 cyberjack usbserial uhci_hcd usbcore parport_pc 
parport via_agp agpgart e1000 tulip crc32 sr_mod aic7xxx scsi_mod
CPU:    0
EIP:    0060:[<f0896e1e>]    Not tainted
EFLAGS: 00210246   (2.6.7-rc2-test-patch) 
EIP is at usb_serial_disconnect+0x1e/0x90 [usbserial]
eax: 00000000   ebx: 00000010   ecx: 00000002   edx: 00000000
esi: 00000000   edi: 00000000   ebp: 00000880   esp: ee491f20
ds: 007b   es: 007b   ss: 0068
Process rmmod (pid: 2166, threadinfo=ee490000 task=e77d6e90)
Stack: c16fd170 c16fd148 00000000 e93c124c 00000000 f089efc0 f08971d2 00000000 
       c16fd138 f089e200 f089f120 c038c140 00000000 f089e06b f089efc0 c012bac0 
       f089f120 00000880 ee491f6c 00000000 65627963 63616a72 4001006b c014455e 
Call Trace:
 [<f08971d2>] usb_serial_deregister+0x92/0xa0 [usbserial]
 [<f089e06b>] cyberjack_exit+0x1b/0x1d [cyberjack]
 [<c012bac0>] sys_delete_module+0x140/0x1b0
 [<c014455e>] do_munmap+0x11e/0x160
 [<c0105f4f>] syscall_call+0x7/0xb

Code: 8b 73 74 75 4d c7 43 74 00 00 00 00 85 f6 74 0b 8d 46 38 89 
************************************************************

I tried to track that oops down for quite a while, unfortunately without
success.  To my knowledge, cyberjack.c doesn't do anything wrong here.

objdump -S -d on the usbserial.o shows me:

00001e00 <usb_serial_disconnect>:
    1e00:       83 ec 18                sub    $0x18,%esp
    1e03:       8b 15 00 00 00 00       mov    0x0,%edx
    1e09:       89 7c 24 14             mov    %edi,0x14(%esp,1)
    1e0d:       8b 7c 24 1c             mov    0x1c(%esp,1),%edi
    1e11:       85 d2                   test   %edx,%edx
    1e13:       89 5c 24 0c             mov    %ebx,0xc(%esp,1)
}

static inline void *
dev_get_drvdata (struct device *dev)
{
    1e17:       8d 5f 10                lea    0x10(%edi),%ebx
    1e1a:       89 74 24 10             mov    %esi,0x10(%esp,1)

static inline void *
dev_get_drvdata (struct device *dev)
{
        return dev->driver_data;
    1e1e:       8b 73 74                mov    0x74(%ebx),%esi
    1e21:       75 4d                   jne    1e70 <usb_serial_disconnect+0x70>


Apparently interface->dev is 0x10 here, thus usb_get_drvdata() inlined by
get_intfdata() dereferences 0x10+0x74 == 0x84

Any ideas?

-- 
- Harald Welte <[EMAIL PROTECTED]>               http://www.gnumonks.org/
============================================================================
Programming is like sex: One mistake and you have to support it your lifetime

Attachment: signature.asc
Description: Digital signature

Reply via email to