From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-7.3 required=3.0 tests=HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,MENTIONS_GIT_HOSTING,SPF_HELO_NONE,SPF_PASS, USER_AGENT_SANE_2 autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id A3282C432C0 for ; Wed, 20 Nov 2019 04:04:13 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 81C2D20715 for ; Wed, 20 Nov 2019 04:04:13 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727578AbfKTEEJ (ORCPT ); Tue, 19 Nov 2019 23:04:09 -0500 Received: from gate.crashing.org ([63.228.1.57]:50026 "EHLO gate.crashing.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727508AbfKTEEJ (ORCPT ); Tue, 19 Nov 2019 23:04:09 -0500 Received: from localhost (localhost.localdomain [127.0.0.1]) by gate.crashing.org (8.14.1/8.14.1) with ESMTP id xAK43hEk022130; Tue, 19 Nov 2019 22:03:44 -0600 Message-ID: <14e1a22937ce5a54d94dab04a103e159215fb654.camel@kernel.crashing.org> Subject: Re: general protection fault in kernfs_add_one From: Benjamin Herrenschmidt To: Linus Torvalds , syzbot , Marcel Holtmann , Johan Hedberg , "David S. Miller" Cc: Greg Kroah-Hartman , Linux Kernel Mailing List , Rafael Wysocki , syzkaller-bugs , Tejun Heo , linux-bluetooth Date: Wed, 20 Nov 2019 15:03:43 +1100 In-Reply-To: References: <000000000000bf6bd30575fec528@google.com> <000000000000e2ac670597ad2663@google.com> Content-Type: text/plain; charset="UTF-8" X-Mailer: Evolution 3.28.5-0ubuntu0.18.04.1 Mime-Version: 1.0 Content-Transfer-Encoding: 7bit Sender: linux-bluetooth-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-bluetooth@vger.kernel.org On Tue, 2019-11-19 at 11:00 -0800, Linus Torvalds wrote: > So looking at the decode, as usual the noise generated by KASAN isn't > being very helpful, but it does look like at least one of the reports > (I picked 5.2 because I don't care about 4.19 etc) is because > 'kernfs_root(kn) is NULL in kernfs_add_one(). > > Looking at the reports, every single one seems to have a call chain > that comes from vhci_write() -> vhci_get_user() -> > vhci_create_device() -> __vhci_create_device() -> hci_register_dev() > -> device_add() -> kobject_add(). > > (In this case, "every single one" is by looking at the last 10 > reports > sorted by date, it wasn't exhaustive). > > The way it got into 'write()' can be a bit varied (splice, write, > whatever). > > That makes me think it's bluetooth that is the problem, but it might > be an effect of how syzbot groups the reports too, of course. > > Might the device have been added at the same time that the last > previous device was removed, so that the parent was deleted as the > new > device was aded? I dunno. The repro seem to be a repeated "open > /dev/vhci, write two random bytes to it" > > Or might it be some "it happens after you've added enough devices > that > something overflows" issue? > > Adding bluetooth people to the cc. Could this be what was fixed by: ac43432cb1f5c2950408534987e57c2071e24d8f ("driver core: Fix use-after-free and double free on glue directory") Which went into 5.3 afaik ? Cheers, Ben. > Linus > > On Mon, Nov 18, 2019 at 10:27 PM syzbot > wrote: > > > > syzbot has bisected this bug to: > > > > commit 726e41097920a73e4c7c33385dcc0debb1281e18 > > Author: Benjamin Herrenschmidt > > Date: Tue Jul 10 00:29:10 2018 +0000 > > > > drivers: core: Remove glue dirs from sysfs earlier > > > > bisection log: > > https://syzkaller.appspot.com/x/bisect.txt?x=168e1012e00000 > > start commit: 5e335542 Merge branch 'for-linus' of > > git://git.kernel.org/.. > > git tree: upstream > > final crash: > > https://syzkaller.appspot.com/x/report.txt?x=158e1012e00000 > > console output: > > https://syzkaller.appspot.com/x/log.txt?x=118e1012e00000 > > kernel config: > > https://syzkaller.appspot.com/x/.config?x=9917ff4b798e1a1e > > dashboard link: > > https://syzkaller.appspot.com/bug?extid=db1637662f412ac0d556 > > syz repro: > > https://syzkaller.appspot.com/x/repro.syz?x=10a66c11400000 > > C reproducer: > > https://syzkaller.appspot.com/x/repro.c?x=1346c771400000 > > > > Reported-by: syzbot+db1637662f412ac0d556@syzkaller.appspotmail.com > > Fixes: 726e41097920 ("drivers: core: Remove glue dirs from sysfs > > earlier") > > > > For information about bisection process see: > > https://goo.gl/tpsmEJ#bisection