hid-bigbenff general protection fault on unplug (Re: hid-sony kernel crash)

Hi there,

unplugging the BigBen gamepad supported by the hid-bigbenff driver 
reliably leads to a general protection fault when memory is allocated by 
something else afterwards, see the log (made with a 5.3.13 kernel).

Apparently, the resource cleanup in bigben_remove() is wrong in some 
way. I wonder if this is somehow related to the problem Roderick 
discussed below or possibly its original cause.

I'm pretty sure that I tested plugging/unplugging/replugging extensively 
when I originally wrote the hid-bigbenff driver against a 4.19/4.20 
kernel tree, so a bisect may be in order, but also cannot rule out that 
my use of devm_kzalloc() was faulty from the start.

If you see something obvious there, I'd be glad if you point it out. Am 
trying to debug this right now (am new to kernel debugging) and will try 
to provide a patch once the bug is identified.

Thanks,

Hanno


Am 30.07.19 um 07:50 schrieb Roderick Colenbrander:

Hi Benjamin and Jiri,

Last week, Valve notified us of a kernel crash in hid-sony when
disconnecting a controller (DS4 or DS3) while rumble is ongoing.

Message-ID: 
[off-list ref]

Hi there,

unplugging the BigBen gamepad supported by the hid-bigbenff driver 
reliably leads to a general protection fault

Wanted to add - this is just caused by plugging in, unplugging and then 
waiting for the next memory allocation.

The GPF happens without rumble effects.

Kind regards,

Hanno

Hi Roderick,

I found the bug, it's a double free.

 > Apparently, the resource cleanup in bigben_remove() is wrong in some
 > way. I wonder if this is somehow related to the problem Roderick
 > discussed below or possibly its original cause.

Just fyi, it's not related to the issue you described back in July about 
the Sony driver in Message-ID: 
[off-list ref].

Will prepare a patch later.

Kind regards,

Hanno