Re: cdrom: cdrom_mrw_exit() NULL ptr deref

[Phillip Potter <phil@philpotter.co.uk>]

On Fri, Jul 11, 2025 at 04:04:17PM +0900, Sergey Senozhatsky wrote:
> Hi,
> 
> We are seeing the same NULL ptr deref upon cdrom release, as reported
> in [1] (Chris Cc-ed) in our fleet.  Currently on 6.6 LTS (could be the
> same for older kernels as well, I didn't check.)
> 
> Phillip, is this a known issue?
> 
> <1>[335443.339244] BUG: kernel NULL pointer dereference, address: 0000000000000010
> <1>[335443.339262] #PF: supervisor read access in kernel mode
> <1>[335443.339268] #PF: error_code(0x0000) - not-present page
> <6>[335443.339273] PGD 0 P4D 0
> <4>[335443.339279] Oops: 0000 [#1] PREEMPT SMP NOPTI
> <4>[335443.339287] CPU: 1 PID: 1988 Comm: cros-disks Not tainted 6.6.76-07501-gd42535a678fb #1 (HASH:7d84 1)
> <4>[335443.339301] RIP: 0010:blk_queue_enter+0x5a/0x250
> <4>[335443.339312] Code: 03 00 00 4c 8d 6d a8 eb 1c 4c 89 e7 4c 89 ee e8 8c 62 be ff 49 f7 86 88 00 00 00 02 00 00 00 0f 85 ce 01 00 00 e8 86 10 bd ff <49> 8b 07 a8 03 0f 85 85 01 00 00 65 48 ff 00 41 83 be 90 00 00 00
> <4>[335443.339318] RSP: 0018:ffff9be08ab03b00 EFLAGS: 00010202
> <4>[335443.339324] RAX: ffff8903aa366300 RBX: 0000000000000000 RCX: ffff9be08ab03cd0
> <4>[335443.339330] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
> <4>[335443.339333] RBP: ffff9be08ab03b58 R08: 0000000000000002 R09: 0000000000001b58
> <4>[335443.339338] R10: ffffffff00000000 R11: ffffffffc0ccd030 R12: 0000000000000328
> <4>[335443.339344] R13: ffff9be08ab03b00 R14: 0000000000000000 R15: 0000000000000010
> <4>[335443.339348] FS: 00007d52be81e900(0000) GS:ffff8904b6040000(0000) knlGS:0000000000000000
> <4>[335443.339357] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> <4>[335443.339362] CR2: 0000000000000010 CR3: 0000000140ac6000 CR4: 0000000000350ee0
> <4>[335443.339367] Call Trace:
> <4>[335443.339372] <TASK>
> <4>[335443.339379] ? __die_body+0xae/0xb0
> <4>[335443.339389] ? page_fault_oops+0x381/0x3e0
> <4>[335443.339398] ? exc_page_fault+0x4f/0xa0
> <4>[335443.339404] ? asm_exc_page_fault+0x22/0x30
> <4>[335443.339416] ? sr_check_events+0x290/0x290 [sr_mod (HASH:ab3e 2)]
> <4>[335443.339432] ? blk_queue_enter+0x5a/0x250
> <4>[335443.339439] blk_mq_alloc_request+0x16a/0x220
> <4>[335443.339450] scsi_execute_cmd+0x65/0x240
> <4>[335443.339458] sr_do_ioctl+0xe3/0x210 [sr_mod (HASH:ab3e 2)]
> <4>[335443.339471] sr_packet+0x3d/0x50 [sr_mod (HASH:ab3e 2)]
> <4>[335443.339482] cdrom_mrw_exit+0xc1/0x240 [cdrom (HASH:9d9a 3)]
> <4>[335443.339497] sr_free_disk+0x45/0x60 [sr_mod (HASH:ab3e 2)]
> <4>[335443.339506] disk_release+0xc8/0xe0
> <4>[335443.339515] device_release+0x39/0x90
> <4>[335443.339523] kobject_release+0x49/0xb0
> <4>[335443.339533] bdev_release+0x19/0x30
> <4>[335443.339540] deactivate_locked_super+0x3b/0x100
> <4>[335443.339548] cleanup_mnt+0xaa/0x160
> <4>[335443.339557] task_work_run+0x6c/0xb0
> <4>[335443.339563] exit_to_user_mode_prepare+0x102/0x120
> <4>[335443.339571] syscall_exit_to_user_mode+0x1a/0x30
> <4>[335443.339577] do_syscall_64+0x7e/0xa0
> <4>[335443.339582] ? exit_to_user_mode_prepare+0x44/0x120
> <4>[335443.339588] entry_SYSCALL_64_after_hwframe+0x55/0xbf
> <4>[335443.339595] RIP: 0033:0x7d52bea41f07
> 
> [1] https://lore.kernel.org/all/CAK2bqVJGsz8r8D-x=4N6p9nXQ=v4AwpMAg2frotmdSdtjvnexg@mail.gmail.com/

Hi Sergey,

I have not been aware of this issue until now, as it pertains to the Uniform
CD-ROM driver, wasn't copied on the original bug report. Happy to do some
debugging by all means though. Please could you give me some more information
about how you're triggering it - i.e. is it particular discs? I am grateful
for any information you can provide.

Regards,
Phil