All of lore.kernel.org
 help / color / mirror / Atom feed
* [PATCH v2] i2c: fix WARNING in pvr2_i2c_core_done
@ 2020-07-22  3:16 B K Karthik
  2020-07-22  4:06 ` syzbot
  0 siblings, 1 reply; 11+ messages in thread
From: B K Karthik @ 2020-07-22  3:16 UTC (permalink / raw)
  To: syzbot, andreyknvl, gregkh, linux-kernel, linux-usb,
	Dan Carpenter, rafael, syzkaller-bugs, Markus Elfring,
	Hillf Danton

[-- Attachment #1: Type: text/plain, Size: 2780 bytes --]

#syz test: https://github.com/google/kasan.git usb-fuzzer

fix WARNING in pvr2_i2c_core_done by
unregistering device in the release handler
instead of the disconnect handler, setting the
linked flag after adding adapter to i2c,
and removing a call to acpi_ut_delete_generic_state()

Reported-by: syzbot+e74a998ca8f1df9cc332@syzkaller.appspotmail.com
Signed-off-by: B K Karthik <bkkarthik@pesu.pes.edu>
---
v1 -> v2:
	remove a call to acpi_ut_delete_generic state
	and set linked flag after adding adapter to
	i2c as suggested by Hillf Danton <hdanton@sina.com>

 drivers/acpi/acpica/utdelete.c               | 5 -----
 drivers/i2c/i2c-core-base.c                  | 2 +-
 drivers/media/usb/pvrusb2/pvrusb2-i2c-core.c | 4 ++--
 3 files changed, 3 insertions(+), 8 deletions(-)

diff --git a/drivers/acpi/acpica/utdelete.c b/drivers/acpi/acpica/utdelete.c
index c365faf4e6cd..e36f51725854 100644
--- a/drivers/acpi/acpica/utdelete.c
+++ b/drivers/acpi/acpica/utdelete.c
@@ -648,11 +648,6 @@ acpi_ut_update_object_reference(union acpi_operand_object *object, u16 action)
 
 	/* Free any stacked Update State objects */
 
-	while (state_list) {
-		state = acpi_ut_pop_generic_state(&state_list);
-		acpi_ut_delete_generic_state(state);
-	}
-
 	return (status);
 }
 
diff --git a/drivers/i2c/i2c-core-base.c b/drivers/i2c/i2c-core-base.c
index 26f03a14a478..2d377d2e89f1 100644
--- a/drivers/i2c/i2c-core-base.c
+++ b/drivers/i2c/i2c-core-base.c
@@ -462,6 +462,7 @@ static void i2c_device_shutdown(struct device *dev)
 
 static void i2c_client_dev_release(struct device *dev)
 {
+	i2c_unregister_device(to_i2c_client(dev));
 	kfree(to_i2c_client(dev));
 }
 
@@ -1527,7 +1528,6 @@ void i2c_del_adapter(struct i2c_adapter *adap)
 		dev_dbg(&adap->dev, "Removing %s at 0x%x\n", client->name,
 			client->addr);
 		list_del(&client->detected);
-		i2c_unregister_device(client);
 	}
 	mutex_unlock(&adap->userspace_clients_lock);
 
diff --git a/drivers/media/usb/pvrusb2/pvrusb2-i2c-core.c b/drivers/media/usb/pvrusb2/pvrusb2-i2c-core.c
index 63db04fe12d3..09b2c878f459 100644
--- a/drivers/media/usb/pvrusb2/pvrusb2-i2c-core.c
+++ b/drivers/media/usb/pvrusb2/pvrusb2-i2c-core.c
@@ -623,9 +623,9 @@ void pvr2_i2c_core_init(struct pvr2_hdw *hdw)
 	hdw->i2c_adap.dev.parent = &hdw->usb_dev->dev;
 	hdw->i2c_adap.algo = &hdw->i2c_algo;
 	hdw->i2c_adap.algo_data = hdw;
-	hdw->i2c_linked = !0;
 	i2c_set_adapdata(&hdw->i2c_adap, &hdw->v4l2_dev);
-	i2c_add_adapter(&hdw->i2c_adap);
+	if (!i2c_add_adapter(&hdw->i2c_adap))
+		hdw->i2c_linked =!0;
 	if (hdw->i2c_func[0x18] == i2c_24xxx_ir) {
 		/* Probe for a different type of IR receiver on this
 		   device.  This is really the only way to differentiate
-- 
2.20.1


[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 659 bytes --]

^ permalink raw reply related	[flat|nested] 11+ messages in thread
* [PATCH] i2c: fix WARNING in pvr2_i2c_core_done
@ 2020-07-21 11:10 B K Karthik
  2020-07-21 11:20 ` syzbot
  0 siblings, 1 reply; 11+ messages in thread
From: B K Karthik @ 2020-07-21 11:10 UTC (permalink / raw)
  To: syzbot+e74a998ca8f1df9cc332, syzkaller-bugs, gregkh, skhan,
	Dan Carpenter, Mike Isely, Mauro Carvalho Chehab, linux-media,
	linux-i2c, linux-kernel

[-- Attachment #1: Type: text/plain, Size: 1090 bytes --]

#syz test: https://github.com/google/kasan.git usb-fuzzer

fix WARNING in pvr2_i2c_core_done by
unregistering device in the release handler
instead of the disconnect handler.

Reported-by: syzbot+e74a998ca8f1df9cc332@syzkaller.appspotmail.com
Signed-off-by: B K Karthik <bkkarthik@pesu.pes.edu>
---
 drivers/i2c/i2c-core-base.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/i2c/i2c-core-base.c b/drivers/i2c/i2c-core-base.c
index 26f03a14a478..2d377d2e89f1 100644
--- a/drivers/i2c/i2c-core-base.c
+++ b/drivers/i2c/i2c-core-base.c
@@ -462,6 +462,7 @@ static void i2c_device_shutdown(struct device *dev)
 
 static void i2c_client_dev_release(struct device *dev)
 {
+	i2c_unregister_device(to_i2c_client(dev));
 	kfree(to_i2c_client(dev));
 }
 
@@ -1527,7 +1528,6 @@ void i2c_del_adapter(struct i2c_adapter *adap)
 		dev_dbg(&adap->dev, "Removing %s at 0x%x\n", client->name,
 			client->addr);
 		list_del(&client->detected);
-		i2c_unregister_device(client);
 	}
 	mutex_unlock(&adap->userspace_clients_lock);
 
-- 
2.20.1


[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 659 bytes --]

^ permalink raw reply related	[flat|nested] 11+ messages in thread
* WARNING in pvr2_i2c_core_done
@ 2019-09-25 12:59 syzbot
  2019-09-25 14:10 ` Alan Stern
  0 siblings, 1 reply; 11+ messages in thread
From: syzbot @ 2019-09-25 12:59 UTC (permalink / raw)
  To: andreyknvl, gregkh, linux-kernel, linux-usb, rafael, syzkaller-bugs

Hello,

syzbot found the following crash on:

HEAD commit:    d9e63adc usb-fuzzer: main usb gadget fuzzer driver
git tree:       https://github.com/google/kasan.git usb-fuzzer
console output: https://syzkaller.appspot.com/x/log.txt?x=16b5fcd5600000
kernel config:  https://syzkaller.appspot.com/x/.config?x=f4fa60e981ee8e6a
dashboard link: https://syzkaller.appspot.com/bug?extid=e74a998ca8f1df9cc332
compiler:       gcc (GCC) 9.0.0 20181231 (experimental)
syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=16ec07b1600000
C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=13ff0871600000

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+e74a998ca8f1df9cc332@syzkaller.appspotmail.com

pvrusb2: Device being rendered inoperable
cx25840 0-0044: Unable to detect h/w, assuming cx23887
cx25840 0-0044: cx23887 A/V decoder found @ 0x88 (pvrusb2_a)
pvrusb2: Attached sub-driver cx25840
pvrusb2: ***WARNING*** pvrusb2 device hardware appears to be jammed and I  
can't clear it.
pvrusb2: You might need to power cycle the pvrusb2 device in order to  
recover.
------------[ cut here ]------------
sysfs group 'power' not found for kobject 'i2c-0'
WARNING: CPU: 0 PID: 102 at fs/sysfs/group.c:278 sysfs_remove_group  
fs/sysfs/group.c:278 [inline]
WARNING: CPU: 0 PID: 102 at fs/sysfs/group.c:278  
sysfs_remove_group+0x155/0x1b0 fs/sysfs/group.c:269
Kernel panic - not syncing: panic_on_warn set ...
CPU: 0 PID: 102 Comm: pvrusb2-context Not tainted 5.3.0+ #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS  
Google 01/01/2011
Call Trace:
  __dump_stack lib/dump_stack.c:77 [inline]
  dump_stack+0xca/0x13e lib/dump_stack.c:113
  panic+0x2a3/0x6da kernel/panic.c:219
  __warn.cold+0x20/0x4a kernel/panic.c:576
  report_bug+0x262/0x2a0 lib/bug.c:186
  fixup_bug arch/x86/kernel/traps.c:179 [inline]
  fixup_bug arch/x86/kernel/traps.c:174 [inline]
  do_error_trap+0x12b/0x1e0 arch/x86/kernel/traps.c:272
  do_invalid_op+0x32/0x40 arch/x86/kernel/traps.c:291
  invalid_op+0x23/0x30 arch/x86/entry/entry_64.S:1028
RIP: 0010:sysfs_remove_group fs/sysfs/group.c:278 [inline]
RIP: 0010:sysfs_remove_group+0x155/0x1b0 fs/sysfs/group.c:269
Code: 48 89 d9 49 8b 14 24 48 b8 00 00 00 00 00 fc ff df 48 c1 e9 03 80 3c  
01 00 75 41 48 8b 33 48 c7 c7 a0 dc d0 85 e8 e0 67 8a ff <0f> 0b eb 95 e8  
72 c4 db ff e9 d2 fe ff ff 48 89 df e8 65 c4 db ff
RSP: 0018:ffff8881d5857c40 EFLAGS: 00010282
RAX: 0000000000000000 RBX: ffffffff85f33f80 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff8128d3fd RDI: ffffed103ab0af7a
RBP: 0000000000000000 R08: ffff8881d5e11800 R09: ffffed103b643ee7
R10: ffffed103b643ee6 R11: ffff8881db21f737 R12: ffff8881d2e68338
R13: ffffffff85f34520 R14: ffff8881d2e68900 R15: ffff8881d5e11800
  dpm_sysfs_remove+0x97/0xb0 drivers/base/power/sysfs.c:741
  device_del+0x12a/0xb10 drivers/base/core.c:2352
  device_unregister+0x11/0x30 drivers/base/core.c:2407
  i2c_del_adapter drivers/i2c/i2c-core-base.c:1596 [inline]
  i2c_del_adapter+0x42b/0x590 drivers/i2c/i2c-core-base.c:1535
  pvr2_i2c_core_done+0x69/0xb6  
drivers/media/usb/pvrusb2/pvrusb2-i2c-core.c:652
  pvr2_hdw_destroy+0x179/0x370 drivers/media/usb/pvrusb2/pvrusb2-hdw.c:2680
  pvr2_context_destroy+0x84/0x230  
drivers/media/usb/pvrusb2/pvrusb2-context.c:70
  pvr2_context_check drivers/media/usb/pvrusb2/pvrusb2-context.c:137 [inline]
  pvr2_context_thread_func+0x657/0x860  
drivers/media/usb/pvrusb2/pvrusb2-context.c:158
  kthread+0x318/0x420 kernel/kthread.c:255
  ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352
Kernel Offset: disabled
Rebooting in 86400 seconds..


---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.

syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot can test patches for this bug, for details see:
https://goo.gl/tpsmEJ#testing-patches

^ permalink raw reply	[flat|nested] 11+ messages in thread
end of thread, other threads:[~2020-07-22  9:18 UTC | newest]

Thread overview: 11+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-07-22  3:16 [PATCH v2] i2c: fix WARNING in pvr2_i2c_core_done B K Karthik
2020-07-22  4:06 ` syzbot
     [not found]   ` <20200722091201.2076-1-hdanton@sina.com>
2020-07-22  9:18     ` B K Karthik
  -- strict thread matches above, loose matches on Subject: below --
2020-07-21 11:10 [PATCH] i2c: fix " B K Karthik
2020-07-21 11:20 ` syzbot
2020-07-21 11:55   ` B K Karthik
2019-09-25 12:59 syzbot
2019-09-25 14:10 ` Alan Stern
2019-09-25 15:34   ` Andrey Konovalov
2019-09-26 21:44     ` Alan Stern
2019-09-27  5:10       ` Greg Kroah-Hartman
2019-09-27 14:21         ` Alan Stern

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.