* [syzbot] [gpio?] general protection fault in gpiolib_seq_stop
@ 2024-12-17 5:09 syzbot
2024-12-17 6:48 ` Edward Adam Davis
` (2 more replies)
0 siblings, 3 replies; 6+ messages in thread
From: syzbot @ 2024-12-17 5:09 UTC (permalink / raw)
To: brgl, linus.walleij, linux-gpio, linux-kernel, syzkaller-bugs
Hello,
syzbot found the following issue on:
HEAD commit: 2d8308bf5b67 Merge tag 'scsi-fixes' of git://git.kernel.or..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=1383bcdf980000
kernel config: https://syzkaller.appspot.com/x/.config?x=99a5586995ec03b2
dashboard link: https://syzkaller.appspot.com/bug?extid=b95d0c98f01e7a95da72
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1189c344580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=103b94f8580000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/66039e873a32/disk-2d8308bf.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/60744ba3f743/vmlinux-2d8308bf.xz
kernel image: https://storage.googleapis.com/syzbot-assets/25731ba013ad/bzImage-2d8308bf.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+b95d0c98f01e7a95da72@syzkaller.appspotmail.com
RDX: 0000000000000008 RSI: 0000000000000000 RDI: 0000000000000003
RBP: 0000000000000001 R08: 00007fffecdd9167 R09: 00007f4106f40032
R10: 0000000000000005 R11: 0000000000000246 R12: 00007f4106f46618
R13: 00007fffecdd95a8 R14: 0000000000000001 R15: 0000000000000001
</TASK>
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN PTI
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
CPU: 0 UID: 0 PID: 5829 Comm: syz-executor520 Not tainted 6.13.0-rc2-syzkaller-00362-g2d8308bf5b67 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/25/2024
RIP: 0010:gpiolib_seq_stop+0x4c/0xe0 drivers/gpio/gpiolib.c:5067
Code: 48 c1 ea 03 80 3c 02 00 0f 85 98 00 00 00 48 8b 9b e0 00 00 00 48 b8 00 00 00 00 00 fc ff df 48 8d 7b 04 48 89 fa 48 c1 ea 03 <0f> b6 14 02 48 89 f8 83 e0 07 83 c0 03 38 d0 7c 04 84 d2 75 60 8b
RSP: 0018:ffffc90003e1fa58 EFLAGS: 00010247
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffff88802463a018
RDX: 0000000000000000 RSI: ffffffff84cc96be RDI: 0000000000000004
RBP: 0000000000000000 R08: 0000000000000dc0 R09: 00000000ffffffff
R10: ffffffff8df7c5d3 R11: 0000000000000001 R12: ffffffff8bb596a0
R13: 0000000000000000 R14: 0000000000000000 R15: ffffc90003e1fc40
FS: 0000555557ff9380(0000) GS:ffff8880b8600000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055e43c381608 CR3: 0000000076408000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
traverse.part.0.constprop.0+0x2bd/0x640 fs/seq_file.c:131
traverse fs/seq_file.c:98 [inline]
seq_read_iter+0x934/0x12b0 fs/seq_file.c:195
seq_read+0x39f/0x4e0 fs/seq_file.c:162
full_proxy_read+0xfb/0x1b0 fs/debugfs/file.c:351
vfs_read+0x1df/0xbe0 fs/read_write.c:563
ksys_pread64 fs/read_write.c:756 [inline]
__do_sys_pread64 fs/read_write.c:764 [inline]
__se_sys_pread64 fs/read_write.c:761 [inline]
__x64_sys_pread64+0x1f6/0x250 fs/read_write.c:761
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f4106edb2e9
Code: 48 83 c4 28 c3 e8 17 1a 00 00 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fffecdd93c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000011
RAX: ffffffffffffffda RBX: 00007fffecdd93d0 RCX: 00007f4106edb2e9
RDX: 0000000000000008 RSI: 0000000000000000 RDI: 0000000000000003
RBP: 0000000000000001 R08: 00007fffecdd9167 R09: 00007f4106f40032
R10: 0000000000000005 R11: 0000000000000246 R12: 00007f4106f46618
R13: 00007fffecdd95a8 R14: 0000000000000001 R15: 0000000000000001
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:gpiolib_seq_stop+0x4c/0xe0 drivers/gpio/gpiolib.c:5067
Code: 48 c1 ea 03 80 3c 02 00 0f 85 98 00 00 00 48 8b 9b e0 00 00 00 48 b8 00 00 00 00 00 fc ff df 48 8d 7b 04 48 89 fa 48 c1 ea 03 <0f> b6 14 02 48 89 f8 83 e0 07 83 c0 03 38 d0 7c 04 84 d2 75 60 8b
RSP: 0018:ffffc90003e1fa58 EFLAGS: 00010247
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffff88802463a018
RDX: 0000000000000000 RSI: ffffffff84cc96be RDI: 0000000000000004
RBP: 0000000000000000 R08: 0000000000000dc0 R09: 00000000ffffffff
R10: ffffffff8df7c5d3 R11: 0000000000000001 R12: ffffffff8bb596a0
R13: 0000000000000000 R14: 0000000000000000 R15: ffffc90003e1fc40
FS: 0000555557ff9380(0000) GS:ffff8880b8700000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000020000080 CR3: 0000000076408000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
0: 48 c1 ea 03 shr $0x3,%rdx
4: 80 3c 02 00 cmpb $0x0,(%rdx,%rax,1)
8: 0f 85 98 00 00 00 jne 0xa6
e: 48 8b 9b e0 00 00 00 mov 0xe0(%rbx),%rbx
15: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax
1c: fc ff df
1f: 48 8d 7b 04 lea 0x4(%rbx),%rdi
23: 48 89 fa mov %rdi,%rdx
26: 48 c1 ea 03 shr $0x3,%rdx
* 2a: 0f b6 14 02 movzbl (%rdx,%rax,1),%edx <-- trapping instruction
2e: 48 89 f8 mov %rdi,%rax
31: 83 e0 07 and $0x7,%eax
34: 83 c0 03 add $0x3,%eax
37: 38 d0 cmp %dl,%al
39: 7c 04 jl 0x3f
3b: 84 d2 test %dl,%dl
3d: 75 60 jne 0x9f
3f: 8b .byte 0x8b
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
^ permalink raw reply [flat|nested] 6+ messages in thread* Re: [syzbot] [gpio?] general protection fault in gpiolib_seq_stop
2024-12-17 5:09 [syzbot] [gpio?] general protection fault in gpiolib_seq_stop syzbot
@ 2024-12-17 6:48 ` Edward Adam Davis
2024-12-17 7:08 ` syzbot
2024-12-17 7:13 ` Edward Adam Davis
2024-12-17 7:37 ` [PATCH] fs/seq_file: Exit the subsequent process when seq start fails Edward Adam Davis
2 siblings, 1 reply; 6+ messages in thread
From: Edward Adam Davis @ 2024-12-17 6:48 UTC (permalink / raw)
To: syzbot+b95d0c98f01e7a95da72
Cc: brgl, linus.walleij, linux-gpio, linux-kernel, syzkaller-bugs
#syz test: https://github.com/ea1davis/linux gpio/syz
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [syzbot] [gpio?] general protection fault in gpiolib_seq_stop
2024-12-17 6:48 ` Edward Adam Davis
@ 2024-12-17 7:08 ` syzbot
0 siblings, 0 replies; 6+ messages in thread
From: syzbot @ 2024-12-17 7:08 UTC (permalink / raw)
To: brgl, eadavis, linus.walleij, linux-gpio, linux-kernel,
syzkaller-bugs
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
WARNING: lock held when returning to user space in gpiolib_seq_start
RBP: 00007fe66f38b090 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000005 R11: 0000000000000246 R12: 0000000000000001
R13: 0000000000000000 R14: 00007fe66e775fa0 R15: 00007ffe92372dd8
</TASK>
================================================
WARNING: lock held when returning to user space!
6.12.0-syzkaller-10299-gc1f7eb90d8d5 #0 Not tainted
------------------------------------------------
syz.0.18/6685 is leaving the kernel with locks still held!
1 lock held by syz.0.18/6685:
#0: ffffffff8e96d590 (gpio_devices_srcu){.+.+}-{0:0}, at: srcu_lock_acquire include/linux/srcu.h:158 [inline]
#0: ffffffff8e96d590 (gpio_devices_srcu){.+.+}-{0:0}, at: srcu_read_lock include/linux/srcu.h:249 [inline]
#0: ffffffff8e96d590 (gpio_devices_srcu){.+.+}-{0:0}, at: gpiolib_seq_start+0x13e/0x270 drivers/gpio/gpiolib.c:5039
Tested on:
commit: c1f7eb90 fs/seq_file: Exit the subsequent process when..
git tree: https://github.com/ea1davis/linux gpio/syz
console output: https://syzkaller.appspot.com/x/log.txt?x=12dfb4f8580000
kernel config: https://syzkaller.appspot.com/x/.config?x=e8d97faf7b870c89
dashboard link: https://syzkaller.appspot.com/bug?extid=b95d0c98f01e7a95da72
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
Note: no patches were applied.
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [syzbot] [gpio?] general protection fault in gpiolib_seq_stop
2024-12-17 5:09 [syzbot] [gpio?] general protection fault in gpiolib_seq_stop syzbot
2024-12-17 6:48 ` Edward Adam Davis
@ 2024-12-17 7:13 ` Edward Adam Davis
2024-12-17 7:34 ` syzbot
2024-12-17 7:37 ` [PATCH] fs/seq_file: Exit the subsequent process when seq start fails Edward Adam Davis
2 siblings, 1 reply; 6+ messages in thread
From: Edward Adam Davis @ 2024-12-17 7:13 UTC (permalink / raw)
To: syzbot+b95d0c98f01e7a95da72
Cc: brgl, linus.walleij, linux-gpio, linux-kernel, syzkaller-bugs
#syz test: https://github.com/ea1davis/linux gpio/syz
^ permalink raw reply [flat|nested] 6+ messages in thread
* [PATCH] fs/seq_file: Exit the subsequent process when seq start fails
2024-12-17 5:09 [syzbot] [gpio?] general protection fault in gpiolib_seq_stop syzbot
2024-12-17 6:48 ` Edward Adam Davis
2024-12-17 7:13 ` Edward Adam Davis
@ 2024-12-17 7:37 ` Edward Adam Davis
2 siblings, 0 replies; 6+ messages in thread
From: Edward Adam Davis @ 2024-12-17 7:37 UTC (permalink / raw)
To: syzbot+b95d0c98f01e7a95da72
Cc: brgl, linus.walleij, linux-gpio, linux-kernel, syzkaller-bugs
syzbot report a null-ptr-deref in gpiolib_seq_stop. [1]
syzbot uses "echo 2 > /proc/thread-self/fail-nth", and in the current thread,
the second memory allocation will trigger a failure.
That is to say, the memory allocation for priv in gpiolib_seq_start() fails,
so m->private is not initialized, which eventually leads to a null pointer
dereference to m->private in gpiolib_seq_stop().
Because this type of problem is recurring, it is best to handle it in the
upper layer of the gpio driver, that is, in fs/seq_file.c, and judge the
pointer returned after m->op->start() returns. If its value is null, exit
the subsequent process.This failure does not affect the next execution of
traverse(), so 0 is returned here.
[1]
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN PTI
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
CPU: 0 UID: 0 PID: 5829 Comm: syz-executor520 Not tainted 6.13.0-rc2-syzkaller-00362-g2d8308bf5b67 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/25/2024
RIP: 0010:gpiolib_seq_stop+0x4c/0xe0 drivers/gpio/gpiolib.c:5067
Code: 48 c1 ea 03 80 3c 02 00 0f 85 98 00 00 00 48 8b 9b e0 00 00 00 48 b8 00 00 00 00 00 fc ff df 48 8d 7b 04 48 89 fa 48 c1 ea 03 <0f> b6 14 02 48 89 f8 83 e0 07 83 c0 03 38 d0 7c 04 84 d2 75 60 8b
RSP: 0018:ffffc90003e1fa58 EFLAGS: 00010247
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffff88802463a018
RDX: 0000000000000000 RSI: ffffffff84cc96be RDI: 0000000000000004
RBP: 0000000000000000 R08: 0000000000000dc0 R09: 00000000ffffffff
R10: ffffffff8df7c5d3 R11: 0000000000000001 R12: ffffffff8bb596a0
R13: 0000000000000000 R14: 0000000000000000 R15: ffffc90003e1fc40
FS: 0000555557ff9380(0000) GS:ffff8880b8600000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055e43c381608 CR3: 0000000076408000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
traverse.part.0.constprop.0+0x2bd/0x640 fs/seq_file.c:131
traverse fs/seq_file.c:98 [inline]
seq_read_iter+0x934/0x12b0 fs/seq_file.c:195
seq_read+0x39f/0x4e0 fs/seq_file.c:162
full_proxy_read+0xfb/0x1b0 fs/debugfs/file.c:351
vfs_read+0x1df/0xbe0 fs/read_write.c:563
ksys_pread64 fs/read_write.c:756 [inline]
__do_sys_pread64 fs/read_write.c:764 [inline]
__se_sys_pread64 fs/read_write.c:761 [inline]
__x64_sys_pread64+0x1f6/0x250 fs/read_write.c:761
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Reported-by: syzbot+b95d0c98f01e7a95da72@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=b95d0c98f01e7a95da72
Tested-by: syzbot+b95d0c98f01e7a95da72@syzkaller.appspotmail.com
Signed-off-by: Edward Adam Davis <eadavis@qq.com>
---
fs/seq_file.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/fs/seq_file.c b/fs/seq_file.c
index 8bbb1ad46335..130424bbcf7d 100644
--- a/fs/seq_file.c
+++ b/fs/seq_file.c
@@ -104,6 +104,9 @@ static int traverse(struct seq_file *m, loff_t offset)
return -ENOMEM;
}
p = m->op->start(m, &m->index);
+ if (!p && !m->private)
+ return 0;
+
while (p) {
error = PTR_ERR(p);
if (IS_ERR(p))
--
2.47.0
^ permalink raw reply related [flat|nested] 6+ messages in thread
end of thread, other threads:[~2024-12-17 7:37 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2024-12-17 5:09 [syzbot] [gpio?] general protection fault in gpiolib_seq_stop syzbot
2024-12-17 6:48 ` Edward Adam Davis
2024-12-17 7:08 ` syzbot
2024-12-17 7:13 ` Edward Adam Davis
2024-12-17 7:34 ` syzbot
2024-12-17 7:37 ` [PATCH] fs/seq_file: Exit the subsequent process when seq start fails Edward Adam Davis
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.