From: Kent Gibson <warthog618@gmail.com>
To: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Andy Shevchenko <andriy.shevchenko@linux.intel.com>,
Heikki Krogerus <heikki.krogerus@linux.intel.com>,
"Rafael J. Wysocki" <rafael@kernel.org>,
linux-acpi@vger.kernel.org, linux-kernel@vger.kernel.org,
Bartosz Golaszewski <brgl@bgdev.pl>
Subject: Re: linux 5.15-rc4: refcount underflow when unloading gpio-mockup
Date: Mon, 4 Oct 2021 17:58:13 +0800 [thread overview]
Message-ID: <20211004095813.GA2874227@sol> (raw)
In-Reply-To: <YVrM8VdLKZUt0i8R@kroah.com>
On Mon, Oct 04, 2021 at 11:44:17AM +0200, Greg Kroah-Hartman wrote:
> On Mon, Oct 04, 2021 at 05:34:16PM +0800, Kent Gibson wrote:
> > Hi,
> >
> > I'm seeing a refcount underflow when I unload the gpio-mockup module on
> > Linux v5.15-rc4 (and going back to v5.15-rc1):
> >
> > # modprobe gpio-mockup gpio_mockup_ranges=-1,4,-1,10
> > # rmmod gpio-mockup
> > ------------[ cut here ]------------
> > refcount_t: underflow; use-after-free.
> > WARNING: CPU: 0 PID: 103 at lib/refcount.c:28 refcount_warn_saturate+0xd1/0x120
> > Modules linked in: gpio_mockup(-)
> > CPU: 0 PID: 103 Comm: rmmod Not tainted 5.15.0-rc4 #1
> > Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014
> > EIP: refcount_warn_saturate+0xd1/0x120
> > Code: e8 a2 b0 3b 00 0f 0b eb 83 80 3d db 2a 8c c1 00 0f 85 76 ff ff ff c7 04 24 88 85 78 c1 b1 01 88 0d db 2a 8c c1 e8 7d b0 3b 00 <0f> 0b e9 5b ff ff ff 80 3d d9 2a 8c c1 00 0f 85 4e ff ff ff c7 04
> > EAX: 00000026 EBX: c250b100 ECX: f5fe8c28 EDX: 00000000
> > ESI: c244860c EDI: c250b100 EBP: c245be84 ESP: c245be80
> > DS: 007b ES: 007b FS: 00d8 GS: 0033 SS: 0068 EFLAGS: 00000296
> > CR0: 80050033 CR2: b7e3c3e1 CR3: 024ba000 CR4: 00000690
> > Call Trace:
> > kobject_put+0xdc/0xf0
> > software_node_notify_remove+0xa8/0xc0
> > device_del+0x15a/0x3e0
> > ? kfree_const+0xf/0x30
> > ? kobject_put+0xa6/0xf0
> > ? module_remove_driver+0x73/0xa0
> > platform_device_del.part.0+0xf/0x80
> > platform_device_unregister+0x19/0x40
> > gpio_mockup_unregister_pdevs+0x13/0x1b [gpio_mockup]
> > gpio_mockup_exit+0x1c/0x68c [gpio_mockup]
> > __ia32_sys_delete_module+0x137/0x1e0
> > ? task_work_run+0x61/0x90
> > ? exit_to_user_mode_prepare+0x1b5/0x1c0
> > __do_fast_syscall_32+0x50/0xc0
> > do_fast_syscall_32+0x32/0x70
> > do_SYSENTER_32+0x15/0x20
> > entry_SYSENTER_32+0x98/0xe7
> > EIP: 0xb7eda549
> > Code: b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 8d 76 00 58 b8 77 00 00 00 cd 80 90 8d 76
> > EAX: ffffffda EBX: 0045a19c ECX: 00000800 EDX: 0045a160
> > ESI: fffffffe EDI: 0045a160 EBP: bff19d08 ESP: bff19cc8
> > DS: 007b ES: 007b FS: 0000 GS: 0033 SS: 007b EFLAGS: 00000202
> > ---[ end trace 3d71387f54bc2d06 ]---
> >
> > I suspect this is related to the recent changes to swnode.c or
> > platform.c, as gpio-mockup hasn't changed, but haven't had the
> > chance to debug further.
>
> Any chance you can run 'git bisect' for this?
>
Will do - just wanted to get the problem out there as a heads-up and in
case anyone had some immediate insight.
Cheers,
Kent.
next prev parent reply other threads:[~2021-10-04 9:58 UTC|newest]
Thread overview: 15+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-10-04 9:34 linux 5.15-rc4: refcount underflow when unloading gpio-mockup Kent Gibson
2021-10-04 9:44 ` Greg Kroah-Hartman
2021-10-04 9:58 ` Kent Gibson [this message]
2021-10-04 12:19 ` Kent Gibson
2021-10-04 12:30 ` Heikki Krogerus
2021-10-04 12:47 ` Kent Gibson
2021-10-04 13:20 ` Heikki Krogerus
2021-10-04 14:17 ` Kent Gibson
2021-10-04 15:28 ` Kent Gibson
2021-10-04 19:56 ` Andy Shevchenko
2021-10-05 0:40 ` Kent Gibson
2021-10-05 8:21 ` Andy Shevchenko
2021-10-05 9:50 ` Heikki Krogerus
2021-10-05 9:53 ` Andy Shevchenko
2021-10-05 9:57 ` Heikki Krogerus
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20211004095813.GA2874227@sol \
--to=warthog618@gmail.com \
--cc=andriy.shevchenko@linux.intel.com \
--cc=brgl@bgdev.pl \
--cc=gregkh@linuxfoundation.org \
--cc=heikki.krogerus@linux.intel.com \
--cc=linux-acpi@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=rafael@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.