* arm64: libgpiod: refcount_t: underflow; use-after-free. @ 2023-02-20 14:59 Naresh Kamboju 2023-02-21 17:13 ` Andy Shevchenko 2023-02-22 12:36 ` Bartosz Golaszewski 0 siblings, 2 replies; 7+ messages in thread From: Naresh Kamboju @ 2023-02-20 14:59 UTC (permalink / raw) To: Linux Media Mailing List, open list, open list:GPIO SUBSYSTEM, lkft-triage Cc: Bartosz Golaszewski, Andy Shevchenko, Ferry Toth, Linus Walleij, warthog618, Arnd Bergmann Following kernel warning notices on qemu-arm64, qemu-arm and also on devices running Linux version v6.2.0 while running libgpiod tests. + ./gpiod.sh /opt/libgpiod/bin/ [INFO] libgpiod test suite [INFO] 117 tests registered [INFO] checking the linux kernel version [INFO] kernel release is v6.2.0 - ok to run tests [INFO] using gpio-tools from '/usr/bin' [ 10.499036] ------------[ cut here ]------------ [ 10.499656] refcount_t: underflow; use-after-free. [ 10.500264] WARNING: CPU: 2 PID: 291 at lib/refcount.c:28 refcount_warn_saturate+0xf4/0x144 [ 10.501306] Modules linked in: gpio_mockup(-) cfg80211 bluetooth rfkill crct10dif_ce fuse drm [ 10.502364] CPU: 2 PID: 291 Comm: gpiod-test Not tainted 6.2.0 #1 [ 10.503229] Hardware name: linux,dummy-virt (DT) [ 10.503883] pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 10.505331] pc : refcount_warn_saturate+0xf4/0x144 [ 10.505723] lr : refcount_warn_saturate+0xf4/0x144 [ 10.506115] sp : ffff800008983cd0 [ 10.506391] x29: ffff800008983cd0 x28: ffff0000c4c4c100 x27: 0000000000000000 [ 10.506961] x26: 0000000000000000 x25: 0000000000000000 x24: 0000000000000000 [ 10.507533] x23: 0000000000000200 x22: ffff0000c4e66800 x21: ffff0000c7734640 [ 10.508104] x20: 0000000000000001 x19: ffff0000c7734600 x18: ffffffffffffffff [ 10.508677] x17: 3d4d455453595342 x16: ffffcf0234432020 x15: ffff800088983957 [ 10.509424] x14: 0000000000000000 x13: 2e656572662d7265 x12: 7466612d65737520 [ 10.510003] x11: 3b776f6c66726564 x10: ffffcf02365db580 x9 : ffffcf0233b20138 [ 10.510575] x8 : 00000000ffffefff x7 : ffffcf02365db580 x6 : 0000000000000001 [ 10.511145] x5 : ffffcf023655f000 x4 : ffffcf023655f2e8 x3 : 0000000000000000 [ 10.511721] x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff0000c4c4c100 [ 10.512294] Call trace: [ 10.512494] refcount_warn_saturate+0xf4/0x144 [ 10.512971] kobject_put+0x164/0x220 [ 10.513224] fwnode_remove_software_node+0x44/0x60 [ 10.513554] gpio_mockup_unregister_pdevs+0x54/0x70 [gpio_mockup] [ 10.513970] gpio_mockup_exit+0x10/0x328 [gpio_mockup] [ 10.514322] __arm64_sys_delete_module+0x190/0x2a0 [ 10.514653] invoke_syscall+0x50/0x120 [ 10.514915] el0_svc_common.constprop.0+0x104/0x124 [ 10.515277] do_el0_svc+0x44/0xcc [ 10.515541] el0_svc+0x30/0x94 [ 10.515788] el0t_64_sync_handler+0xbc/0x13c [ 10.516126] el0t_64_sync+0x190/0x194 [ 10.516419] ---[ end trace 0000000000000000 ]--- Build and test logs, https://qa-reports.linaro.org/lkft/linux-mainline-master/build/v6.2/testrun/14856342/suite/libgpiod/test/ctxless-get-value-single-line/log https://qa-reports.linaro.org/lkft/linux-mainline-master/build/v6.2/testrun/14856342/suite/libgpiod/tests/ -- Linaro LKFT https://lkft.linaro.org ^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: arm64: libgpiod: refcount_t: underflow; use-after-free. 2023-02-20 14:59 arm64: libgpiod: refcount_t: underflow; use-after-free Naresh Kamboju @ 2023-02-21 17:13 ` Andy Shevchenko 2023-02-21 17:54 ` Andy Shevchenko 2023-02-22 12:36 ` Bartosz Golaszewski 1 sibling, 1 reply; 7+ messages in thread From: Andy Shevchenko @ 2023-02-21 17:13 UTC (permalink / raw) To: Naresh Kamboju Cc: Linux Media Mailing List, open list, open list:GPIO SUBSYSTEM, lkft-triage, Bartosz Golaszewski, Ferry Toth, Linus Walleij, warthog618, Arnd Bergmann On Mon, Feb 20, 2023 at 08:29:27PM +0530, Naresh Kamboju wrote: > Following kernel warning notices on qemu-arm64, qemu-arm and also on devices > running Linux version v6.2.0 while running libgpiod tests. > > + ./gpiod.sh /opt/libgpiod/bin/ > [INFO] libgpiod test suite > [INFO] 117 tests registered > [INFO] checking the linux kernel version > [INFO] kernel release is v6.2.0 - ok to run tests > [INFO] using gpio-tools from '/usr/bin' > [ 10.499036] ------------[ cut here ]------------ > [ 10.499656] refcount_t: underflow; use-after-free. > [ 10.500264] WARNING: CPU: 2 PID: 291 at lib/refcount.c:28 > refcount_warn_saturate+0xf4/0x144 > [ 10.501306] Modules linked in: gpio_mockup(-) cfg80211 bluetooth > rfkill crct10dif_ce fuse drm > [ 10.502364] CPU: 2 PID: 291 Comm: gpiod-test Not tainted 6.2.0 #1 > [ 10.503229] Hardware name: linux,dummy-virt (DT) > [ 10.503883] pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) > [ 10.505331] pc : refcount_warn_saturate+0xf4/0x144 > [ 10.505723] lr : refcount_warn_saturate+0xf4/0x144 > [ 10.506115] sp : ffff800008983cd0 > [ 10.506391] x29: ffff800008983cd0 x28: ffff0000c4c4c100 x27: 0000000000000000 > [ 10.506961] x26: 0000000000000000 x25: 0000000000000000 x24: 0000000000000000 > [ 10.507533] x23: 0000000000000200 x22: ffff0000c4e66800 x21: ffff0000c7734640 > [ 10.508104] x20: 0000000000000001 x19: ffff0000c7734600 x18: ffffffffffffffff > [ 10.508677] x17: 3d4d455453595342 x16: ffffcf0234432020 x15: ffff800088983957 > [ 10.509424] x14: 0000000000000000 x13: 2e656572662d7265 x12: 7466612d65737520 > [ 10.510003] x11: 3b776f6c66726564 x10: ffffcf02365db580 x9 : ffffcf0233b20138 > [ 10.510575] x8 : 00000000ffffefff x7 : ffffcf02365db580 x6 : 0000000000000001 > [ 10.511145] x5 : ffffcf023655f000 x4 : ffffcf023655f2e8 x3 : 0000000000000000 > [ 10.511721] x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff0000c4c4c100 > [ 10.512294] Call trace: > [ 10.512494] refcount_warn_saturate+0xf4/0x144 > [ 10.512971] kobject_put+0x164/0x220 > [ 10.513224] fwnode_remove_software_node+0x44/0x60 > [ 10.513554] gpio_mockup_unregister_pdevs+0x54/0x70 [gpio_mockup] > [ 10.513970] gpio_mockup_exit+0x10/0x328 [gpio_mockup] > [ 10.514322] __arm64_sys_delete_module+0x190/0x2a0 > [ 10.514653] invoke_syscall+0x50/0x120 > [ 10.514915] el0_svc_common.constprop.0+0x104/0x124 > [ 10.515277] do_el0_svc+0x44/0xcc > [ 10.515541] el0_svc+0x30/0x94 > [ 10.515788] el0t_64_sync_handler+0xbc/0x13c > [ 10.516126] el0t_64_sync+0x190/0x194 > [ 10.516419] ---[ end trace 0000000000000000 ]--- > > > Build and test logs, > https://qa-reports.linaro.org/lkft/linux-mainline-master/build/v6.2/testrun/14856342/suite/libgpiod/test/ctxless-get-value-single-line/log > https://qa-reports.linaro.org/lkft/linux-mainline-master/build/v6.2/testrun/14856342/suite/libgpiod/tests/ Can you give a try of the patch below? diff --git a/drivers/base/platform.c b/drivers/base/platform.c index 77510e4f47de..1807678f032b 100644 --- a/drivers/base/platform.c +++ b/drivers/base/platform.c @@ -557,7 +557,7 @@ static void platform_device_release(struct device *dev) struct platform_object *pa = container_of(dev, struct platform_object, pdev.dev); - of_node_put(pa->pdev.dev.of_node); + fwnode_handle_put(dev_fwnode(&pa->pdev.dev)); kfree(pa->pdev.dev.platform_data); kfree(pa->pdev.mfd_cell); kfree(pa->pdev.resource); @@ -814,8 +814,7 @@ struct platform_device *platform_device_register_full( return ERR_PTR(-ENOMEM); pdev->dev.parent = pdevinfo->parent; - pdev->dev.fwnode = pdevinfo->fwnode; - pdev->dev.of_node = of_node_get(to_of_node(pdev->dev.fwnode)); + device_set_node(&pdev->dev, fwnode_handle_get(pdevinfo->fwnode)); pdev->dev.of_node_reused = pdevinfo->of_node_reused; if (pdevinfo->dma_mask) { @@ -844,8 +843,8 @@ struct platform_device *platform_device_register_full( ret = platform_device_add(pdev); if (ret) { err: - ACPI_COMPANION_SET(&pdev->dev, NULL); platform_device_put(pdev); + fwnode_handle_put(pdevinfo->fwnode); return ERR_PTR(ret); } -- With Best Regards, Andy Shevchenko ^ permalink raw reply related [flat|nested] 7+ messages in thread
* Re: arm64: libgpiod: refcount_t: underflow; use-after-free. 2023-02-21 17:13 ` Andy Shevchenko @ 2023-02-21 17:54 ` Andy Shevchenko 2023-06-07 18:32 ` Anders Roxell 0 siblings, 1 reply; 7+ messages in thread From: Andy Shevchenko @ 2023-02-21 17:54 UTC (permalink / raw) To: Naresh Kamboju Cc: Linux Media Mailing List, open list, open list:GPIO SUBSYSTEM, lkft-triage, Bartosz Golaszewski, Ferry Toth, Linus Walleij, warthog618, Arnd Bergmann On Tue, Feb 21, 2023 at 07:13:31PM +0200, Andy Shevchenko wrote: > On Mon, Feb 20, 2023 at 08:29:27PM +0530, Naresh Kamboju wrote: > > Following kernel warning notices on qemu-arm64, qemu-arm and also on devices > > running Linux version v6.2.0 while running libgpiod tests. ... > - ACPI_COMPANION_SET(&pdev->dev, NULL); This line should stay otherwise it will remove the device that may share the fwnode with this newly created platform device. -- With Best Regards, Andy Shevchenko ^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: arm64: libgpiod: refcount_t: underflow; use-after-free. 2023-02-21 17:54 ` Andy Shevchenko @ 2023-06-07 18:32 ` Anders Roxell 0 siblings, 0 replies; 7+ messages in thread From: Anders Roxell @ 2023-06-07 18:32 UTC (permalink / raw) To: Andy Shevchenko Cc: Naresh Kamboju, Linux Media Mailing List, open list, open list:GPIO SUBSYSTEM, lkft-triage, Bartosz Golaszewski, Ferry Toth, Linus Walleij, warthog618, Arnd Bergmann On Tue, 21 Feb 2023 at 18:54, Andy Shevchenko <andriy.shevchenko@linux.intel.com> wrote: > > On Tue, Feb 21, 2023 at 07:13:31PM +0200, Andy Shevchenko wrote: > > On Mon, Feb 20, 2023 at 08:29:27PM +0530, Naresh Kamboju wrote: > > > Following kernel warning notices on qemu-arm64, qemu-arm and also on devices > > > running Linux version v6.2.0 while running libgpiod tests. > > ... > > > - ACPI_COMPANION_SET(&pdev->dev, NULL); > > This line should stay otherwise it will remove the device that may share > the fwnode with this newly created platform device. > I was this issue on todays next tag: next-20230607 too, when I ran libgpiod v1.6.4, and I trieed to apply your proposed patch, but it didn't solve the "refcount_t: underflow; use-after-free.". However, understand that I shouldn't run libgpiod v1.6.4, but I did by accident. Not sure that I think I should get a use-after-free if I run the wrong version of the test-suite or? Running with libgpiod v2.0.1 I do not see this use-after-free issue. This is how I reproduced the issue on todays next tag next-20230607, I use tuxmake [1] to build the kernel and tuxrun [2] to run test with the booted kernel. $git checkout next-20230607 $ tuxmake --runtime podman --target-arch arm64 --toolchain gcc-12 --kconfig defconfig --kconfig-add https://raw.githubusercontent.com/Linaro/meta-lkft/kirkstone/meta/recipes-kernel/linux/files/lkft.config --kconfig-add https://raw.githubusercontent.com/Linaro/meta-lkft/kirkstone/meta/recipes-kernel/linux/files/lkft-crypto.config --kconfig-add https://raw.githubusercontent.com/Linaro/meta-lkft/kirkstone/meta/recipes-kernel/linux/files/distro-overrides.config --kconfig-add https://raw.githubusercontent.com/Linaro/meta-lkft/kirkstone/meta/recipes-kernel/linux/files/systemd.config --kconfig-add https://raw.githubusercontent.com/Linaro/meta-lkft/kirkstone/meta/recipes-kernel/linux/files/virtio.config --kconfig-add CONFIG_ARM64_MODULE_PLTS=y --kconfig-add CONFIG_SYN_COOKIES=y --kconfig-add CONFIG_SCHEDSTATS=y --kconfig-add CONFIG_GPIOLIB=y --kconfig-add CONFIG_GPIO_CDEV=y --kconfig-add CONFIG_GPIO_MOCKUP=m --kconfig-add CONFIG_GPIO_SIM=m --results-hook 'tuxrun --runtime podman --device qemu-arm64 --boot-args rw --tuxmake ./ --rootfs https://storage.tuxboot.com/debian/bookworm/arm64/rootfs.ext4.xz --parameters SKIPFILE=skipfile-lkft.yaml --tests libgpiod --timeouts boot=30 --overlay https://storage.dev.tuxboot.com/overlays/debian/bookworm/arm64/libgpiod/v1.6.4/libgpiod.tar.xz --save-output --log-file -' Cheers, Anders [1] https://tuxmake.org/ [2] https://tuxrun.org/ ^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: arm64: libgpiod: refcount_t: underflow; use-after-free. 2023-02-20 14:59 arm64: libgpiod: refcount_t: underflow; use-after-free Naresh Kamboju 2023-02-21 17:13 ` Andy Shevchenko @ 2023-02-22 12:36 ` Bartosz Golaszewski 2023-06-07 18:35 ` Anders Roxell 1 sibling, 1 reply; 7+ messages in thread From: Bartosz Golaszewski @ 2023-02-22 12:36 UTC (permalink / raw) To: Naresh Kamboju Cc: Linux Media Mailing List, open list, open list:GPIO SUBSYSTEM, lkft-triage, Andy Shevchenko, Ferry Toth, Linus Walleij, warthog618, Arnd Bergmann On Mon, Feb 20, 2023 at 3:59 PM Naresh Kamboju <naresh.kamboju@linaro.org> wrote: > > Following kernel warning notices on qemu-arm64, qemu-arm and also on devices > running Linux version v6.2.0 while running libgpiod tests. > I don't see it on v6.2 with libgpiod v1.6.4. Seeing the output of the test script, it seems you're using an old version - what is it? > + ./gpiod.sh /opt/libgpiod/bin/ What's in gpiod.sh? Bart > [INFO] libgpiod test suite > [INFO] 117 tests registered > [INFO] checking the linux kernel version > [INFO] kernel release is v6.2.0 - ok to run tests > [INFO] using gpio-tools from '/usr/bin' > [ 10.499036] ------------[ cut here ]------------ > [ 10.499656] refcount_t: underflow; use-after-free. > [ 10.500264] WARNING: CPU: 2 PID: 291 at lib/refcount.c:28 > refcount_warn_saturate+0xf4/0x144 > [ 10.501306] Modules linked in: gpio_mockup(-) cfg80211 bluetooth > rfkill crct10dif_ce fuse drm > [ 10.502364] CPU: 2 PID: 291 Comm: gpiod-test Not tainted 6.2.0 #1 > [ 10.503229] Hardware name: linux,dummy-virt (DT) > [ 10.503883] pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) > [ 10.505331] pc : refcount_warn_saturate+0xf4/0x144 > [ 10.505723] lr : refcount_warn_saturate+0xf4/0x144 > [ 10.506115] sp : ffff800008983cd0 > [ 10.506391] x29: ffff800008983cd0 x28: ffff0000c4c4c100 x27: 0000000000000000 > [ 10.506961] x26: 0000000000000000 x25: 0000000000000000 x24: 0000000000000000 > [ 10.507533] x23: 0000000000000200 x22: ffff0000c4e66800 x21: ffff0000c7734640 > [ 10.508104] x20: 0000000000000001 x19: ffff0000c7734600 x18: ffffffffffffffff > [ 10.508677] x17: 3d4d455453595342 x16: ffffcf0234432020 x15: ffff800088983957 > [ 10.509424] x14: 0000000000000000 x13: 2e656572662d7265 x12: 7466612d65737520 > [ 10.510003] x11: 3b776f6c66726564 x10: ffffcf02365db580 x9 : ffffcf0233b20138 > [ 10.510575] x8 : 00000000ffffefff x7 : ffffcf02365db580 x6 : 0000000000000001 > [ 10.511145] x5 : ffffcf023655f000 x4 : ffffcf023655f2e8 x3 : 0000000000000000 > [ 10.511721] x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff0000c4c4c100 > [ 10.512294] Call trace: > [ 10.512494] refcount_warn_saturate+0xf4/0x144 > [ 10.512971] kobject_put+0x164/0x220 > [ 10.513224] fwnode_remove_software_node+0x44/0x60 > [ 10.513554] gpio_mockup_unregister_pdevs+0x54/0x70 [gpio_mockup] > [ 10.513970] gpio_mockup_exit+0x10/0x328 [gpio_mockup] > [ 10.514322] __arm64_sys_delete_module+0x190/0x2a0 > [ 10.514653] invoke_syscall+0x50/0x120 > [ 10.514915] el0_svc_common.constprop.0+0x104/0x124 > [ 10.515277] do_el0_svc+0x44/0xcc > [ 10.515541] el0_svc+0x30/0x94 > [ 10.515788] el0t_64_sync_handler+0xbc/0x13c > [ 10.516126] el0t_64_sync+0x190/0x194 > [ 10.516419] ---[ end trace 0000000000000000 ]--- > > > Build and test logs, > https://qa-reports.linaro.org/lkft/linux-mainline-master/build/v6.2/testrun/14856342/suite/libgpiod/test/ctxless-get-value-single-line/log > https://qa-reports.linaro.org/lkft/linux-mainline-master/build/v6.2/testrun/14856342/suite/libgpiod/tests/ > > > -- > Linaro LKFT > https://lkft.linaro.org ^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: arm64: libgpiod: refcount_t: underflow; use-after-free. 2023-02-22 12:36 ` Bartosz Golaszewski @ 2023-06-07 18:35 ` Anders Roxell 2023-06-07 19:34 ` Bartosz Golaszewski 0 siblings, 1 reply; 7+ messages in thread From: Anders Roxell @ 2023-06-07 18:35 UTC (permalink / raw) To: Bartosz Golaszewski Cc: Naresh Kamboju, Linux Media Mailing List, open list, open list:GPIO SUBSYSTEM, lkft-triage, Andy Shevchenko, Ferry Toth, Linus Walleij, warthog618, Arnd Bergmann On Wed, 22 Feb 2023 at 13:36, Bartosz Golaszewski <brgl@bgdev.pl> wrote: > > On Mon, Feb 20, 2023 at 3:59 PM Naresh Kamboju > <naresh.kamboju@linaro.org> wrote: > > > > Following kernel warning notices on qemu-arm64, qemu-arm and also on devices > > running Linux version v6.2.0 while running libgpiod tests. > > > > I don't see it on v6.2 with libgpiod v1.6.4. Seeing the output of the > test script, it seems you're using an old version - what is it? Yes, I did run libgpiod v1.6.4 by mistake on todays next-20230607 tag. Not sure if I should or should not get the use-after-free warning by running the "wrong version" of a test suite or? > > > + ./gpiod.sh /opt/libgpiod/bin/ > > What's in gpiod.sh? its a wrapper script around gpiod-test [1] to parse the output to be understood by our test framework Cheers, Anders [1] https://github.com/Linaro/test-definitions/blob/master/automated/linux/gpiod/gpiod.sh > > Bart > > > [INFO] libgpiod test suite > > [INFO] 117 tests registered > > [INFO] checking the linux kernel version > > [INFO] kernel release is v6.2.0 - ok to run tests > > [INFO] using gpio-tools from '/usr/bin' > > [ 10.499036] ------------[ cut here ]------------ > > [ 10.499656] refcount_t: underflow; use-after-free. > > [ 10.500264] WARNING: CPU: 2 PID: 291 at lib/refcount.c:28 > > refcount_warn_saturate+0xf4/0x144 > > [ 10.501306] Modules linked in: gpio_mockup(-) cfg80211 bluetooth > > rfkill crct10dif_ce fuse drm > > [ 10.502364] CPU: 2 PID: 291 Comm: gpiod-test Not tainted 6.2.0 #1 > > [ 10.503229] Hardware name: linux,dummy-virt (DT) > > [ 10.503883] pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) > > [ 10.505331] pc : refcount_warn_saturate+0xf4/0x144 > > [ 10.505723] lr : refcount_warn_saturate+0xf4/0x144 > > [ 10.506115] sp : ffff800008983cd0 > > [ 10.506391] x29: ffff800008983cd0 x28: ffff0000c4c4c100 x27: 0000000000000000 > > [ 10.506961] x26: 0000000000000000 x25: 0000000000000000 x24: 0000000000000000 > > [ 10.507533] x23: 0000000000000200 x22: ffff0000c4e66800 x21: ffff0000c7734640 > > [ 10.508104] x20: 0000000000000001 x19: ffff0000c7734600 x18: ffffffffffffffff > > [ 10.508677] x17: 3d4d455453595342 x16: ffffcf0234432020 x15: ffff800088983957 > > [ 10.509424] x14: 0000000000000000 x13: 2e656572662d7265 x12: 7466612d65737520 > > [ 10.510003] x11: 3b776f6c66726564 x10: ffffcf02365db580 x9 : ffffcf0233b20138 > > [ 10.510575] x8 : 00000000ffffefff x7 : ffffcf02365db580 x6 : 0000000000000001 > > [ 10.511145] x5 : ffffcf023655f000 x4 : ffffcf023655f2e8 x3 : 0000000000000000 > > [ 10.511721] x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff0000c4c4c100 > > [ 10.512294] Call trace: > > [ 10.512494] refcount_warn_saturate+0xf4/0x144 > > [ 10.512971] kobject_put+0x164/0x220 > > [ 10.513224] fwnode_remove_software_node+0x44/0x60 > > [ 10.513554] gpio_mockup_unregister_pdevs+0x54/0x70 [gpio_mockup] > > [ 10.513970] gpio_mockup_exit+0x10/0x328 [gpio_mockup] > > [ 10.514322] __arm64_sys_delete_module+0x190/0x2a0 > > [ 10.514653] invoke_syscall+0x50/0x120 > > [ 10.514915] el0_svc_common.constprop.0+0x104/0x124 > > [ 10.515277] do_el0_svc+0x44/0xcc > > [ 10.515541] el0_svc+0x30/0x94 > > [ 10.515788] el0t_64_sync_handler+0xbc/0x13c > > [ 10.516126] el0t_64_sync+0x190/0x194 > > [ 10.516419] ---[ end trace 0000000000000000 ]--- > > > > > > Build and test logs, > > https://qa-reports.linaro.org/lkft/linux-mainline-master/build/v6.2/testrun/14856342/suite/libgpiod/test/ctxless-get-value-single-line/log > > https://qa-reports.linaro.org/lkft/linux-mainline-master/build/v6.2/testrun/14856342/suite/libgpiod/tests/ > > > > > > -- > > Linaro LKFT > > https://lkft.linaro.org ^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: arm64: libgpiod: refcount_t: underflow; use-after-free. 2023-06-07 18:35 ` Anders Roxell @ 2023-06-07 19:34 ` Bartosz Golaszewski 0 siblings, 0 replies; 7+ messages in thread From: Bartosz Golaszewski @ 2023-06-07 19:34 UTC (permalink / raw) To: Anders Roxell Cc: Naresh Kamboju, Linux Media Mailing List, open list, open list:GPIO SUBSYSTEM, lkft-triage, Andy Shevchenko, Ferry Toth, Linus Walleij, warthog618, Arnd Bergmann On Wed, Jun 7, 2023 at 8:35 PM Anders Roxell <anders.roxell@linaro.org> wrote: > > On Wed, 22 Feb 2023 at 13:36, Bartosz Golaszewski <brgl@bgdev.pl> wrote: > > > > On Mon, Feb 20, 2023 at 3:59 PM Naresh Kamboju > > <naresh.kamboju@linaro.org> wrote: > > > > > > Following kernel warning notices on qemu-arm64, qemu-arm and also on devices > > > running Linux version v6.2.0 while running libgpiod tests. > > > > > > > I don't see it on v6.2 with libgpiod v1.6.4. Seeing the output of the > > test script, it seems you're using an old version - what is it? > > Yes, I did run libgpiod v1.6.4 by mistake on todays next-20230607 tag. > Not sure if I should or should not get the use-after-free warning by > running the "wrong version" > of a test suite or? > It doesn't matter, v1.6.4 is still supported. I'll give it a try tomorrow. Brt > > > > > + ./gpiod.sh /opt/libgpiod/bin/ > > > > What's in gpiod.sh? > > its a wrapper script around gpiod-test [1] to parse the output to be > understood by our test framework > > Cheers, > Anders > [1] https://github.com/Linaro/test-definitions/blob/master/automated/linux/gpiod/gpiod.sh > > > > > Bart > > > > > [INFO] libgpiod test suite > > > [INFO] 117 tests registered > > > [INFO] checking the linux kernel version > > > [INFO] kernel release is v6.2.0 - ok to run tests > > > [INFO] using gpio-tools from '/usr/bin' > > > [ 10.499036] ------------[ cut here ]------------ > > > [ 10.499656] refcount_t: underflow; use-after-free. > > > [ 10.500264] WARNING: CPU: 2 PID: 291 at lib/refcount.c:28 > > > refcount_warn_saturate+0xf4/0x144 > > > [ 10.501306] Modules linked in: gpio_mockup(-) cfg80211 bluetooth > > > rfkill crct10dif_ce fuse drm > > > [ 10.502364] CPU: 2 PID: 291 Comm: gpiod-test Not tainted 6.2.0 #1 > > > [ 10.503229] Hardware name: linux,dummy-virt (DT) > > > [ 10.503883] pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) > > > [ 10.505331] pc : refcount_warn_saturate+0xf4/0x144 > > > [ 10.505723] lr : refcount_warn_saturate+0xf4/0x144 > > > [ 10.506115] sp : ffff800008983cd0 > > > [ 10.506391] x29: ffff800008983cd0 x28: ffff0000c4c4c100 x27: 0000000000000000 > > > [ 10.506961] x26: 0000000000000000 x25: 0000000000000000 x24: 0000000000000000 > > > [ 10.507533] x23: 0000000000000200 x22: ffff0000c4e66800 x21: ffff0000c7734640 > > > [ 10.508104] x20: 0000000000000001 x19: ffff0000c7734600 x18: ffffffffffffffff > > > [ 10.508677] x17: 3d4d455453595342 x16: ffffcf0234432020 x15: ffff800088983957 > > > [ 10.509424] x14: 0000000000000000 x13: 2e656572662d7265 x12: 7466612d65737520 > > > [ 10.510003] x11: 3b776f6c66726564 x10: ffffcf02365db580 x9 : ffffcf0233b20138 > > > [ 10.510575] x8 : 00000000ffffefff x7 : ffffcf02365db580 x6 : 0000000000000001 > > > [ 10.511145] x5 : ffffcf023655f000 x4 : ffffcf023655f2e8 x3 : 0000000000000000 > > > [ 10.511721] x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff0000c4c4c100 > > > [ 10.512294] Call trace: > > > [ 10.512494] refcount_warn_saturate+0xf4/0x144 > > > [ 10.512971] kobject_put+0x164/0x220 > > > [ 10.513224] fwnode_remove_software_node+0x44/0x60 > > > [ 10.513554] gpio_mockup_unregister_pdevs+0x54/0x70 [gpio_mockup] > > > [ 10.513970] gpio_mockup_exit+0x10/0x328 [gpio_mockup] > > > [ 10.514322] __arm64_sys_delete_module+0x190/0x2a0 > > > [ 10.514653] invoke_syscall+0x50/0x120 > > > [ 10.514915] el0_svc_common.constprop.0+0x104/0x124 > > > [ 10.515277] do_el0_svc+0x44/0xcc > > > [ 10.515541] el0_svc+0x30/0x94 > > > [ 10.515788] el0t_64_sync_handler+0xbc/0x13c > > > [ 10.516126] el0t_64_sync+0x190/0x194 > > > [ 10.516419] ---[ end trace 0000000000000000 ]--- > > > > > > > > > Build and test logs, > > > https://qa-reports.linaro.org/lkft/linux-mainline-master/build/v6.2/testrun/14856342/suite/libgpiod/test/ctxless-get-value-single-line/log > > > https://qa-reports.linaro.org/lkft/linux-mainline-master/build/v6.2/testrun/14856342/suite/libgpiod/tests/ > > > > > > > > > -- > > > Linaro LKFT > > > https://lkft.linaro.org ^ permalink raw reply [flat|nested] 7+ messages in thread
end of thread, other threads:[~2023-06-07 19:35 UTC | newest] Thread overview: 7+ messages (download: mbox.gz follow: Atom feed -- links below jump to the message on this page -- 2023-02-20 14:59 arm64: libgpiod: refcount_t: underflow; use-after-free Naresh Kamboju 2023-02-21 17:13 ` Andy Shevchenko 2023-02-21 17:54 ` Andy Shevchenko 2023-06-07 18:32 ` Anders Roxell 2023-02-22 12:36 ` Bartosz Golaszewski 2023-06-07 18:35 ` Anders Roxell 2023-06-07 19:34 ` Bartosz Golaszewski
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox