linux-kernel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: "Yang, Chenyuan" <cy54@illinois.edu>
To: Hans Verkuil <hverkuil-cisco@xs4all.nl>,
	"linux-media@vger.kernel.org" <linux-media@vger.kernel.org>,
	"linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>
Cc: "jani.nikula@intel.com" <jani.nikula@intel.com>,
	"syzkaller@googlegroups.com" <syzkaller@googlegroups.com>,
	"mchehab@kernel.org" <mchehab@kernel.org>,
	"Zhao, Zijie" <zijie4@illinois.edu>,
	"Zhang, Lingming" <lingming@illinois.edu>
Subject: Re: [Linux Kernel Bugs] KASAN: slab-use-after-free Read in cec_queue_msg_fh and 4 other crashes in the cec device (`cec_ioctl`)
Date: Tue, 13 Feb 2024 16:05:11 +0000	[thread overview]
Message-ID: <0C7B75A2-B4C8-43CB-A57A-910B3674E787@illinois.edu> (raw)
In-Reply-To: <F8D4A291-8CFB-4A25-B296-3CA07B56F459@illinois.edu>

[-- Attachment #1: Type: text/plain, Size: 14642 bytes --]

Hi Hans,

Here is the output for the first warning and its C reproducer is attached:

```
[   69.031655][ T7985] sshd (7985) used greatest stack depth: 21808 bytes left
[  135.592879][ T8039] cec-vivid-000-vid-out0: wfc1: 0000000000000000 0110 1000
[  135.592987][ T8040] cec-vivid-001-vid-out0: wfc1: 0000000000000000 0110 1000
```

Best,
Chenyuan

On 2/13/24, 9:40 AM, "syzkaller@googlegroups.com <mailto:syzkaller@googlegroups.com> on behalf of Yang, Chenyuan" <syzkaller@googlegroups.com <mailto:syzkaller@googlegroups.com> on behalf of cy54@illinois.edu <mailto:cy54@illinois.edu>> wrote:


Hi Hans,


Sorry to reply so late.


Here is the reproducible C program that could trigger the following debug warning:
```
if ((wait_for_completion_killable_timeout(&adap->config_completion, msecs_to_jiffies(10000)) <= 0)) {
dprintk(0, "wfc3: %px %d%d%d%d %x\n", adap->kthread_config,
adap->is_configuring, adap->is_configured,
adap->is_enabled, adap->must_reconfigure, adap->phys_addr);
WARN_ON(1);
}
```


Output:


```
[ 2147.996471][ T29] kauditd_printk_skb: 2 callbacks suppressed
[ 2147.996480][ T29] audit: type=1804 audit(1707782435.859:14): pid=1281266 uid=0 auid=4290
[ 2148.025365][ T29] audit: type=1804 audit(1707782435.879:15): pid=1281266 uid=0 auid=4290
[54569.994174][T772636] cec-vivid-002-vid-cap0: wfc3: 0000000000000000 0110 0


[54569.995754][T772636] WARNING: CPU: 0 PID: 772636 at drivers/media/cec/core/cec-adap.c:1620
[54569.996578][T772636] Modules linked in:
[54569.997066][T772636] CPU: 0 PID: 772636 Comm: exe Not tainted 6.8.0-rc1-00169-gecb1b8288d5
[54569.997804][T772636] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-14
[54569.998416][T772636] RIP: 0010:cec_claim_log_addrs+0x29b/0x7c0
[54569.998830][T772636] Code: 7c 08 84 d2 0f 85 50 04 00 00 44 8b 25 ee 33 9f 0b 31 ff 44 89f
[54570.000124][T772636] RSP: 0018:ffffc90002117b30 EFLAGS: 00010293
[54570.000549][T772636] RAX: 0000000000000000 RBX: ffff88801d6a0000 RCX: ffffffff816a1959
[54570.001086][T772636] RDX: ffff888028e4b900 RSI: ffffffff8710b1ca RDI: 0000000000000005
[54570.001621][T772636] RBP: ffff88801d6a0638 R08: 0000000000000005 R09: 0000000000000000
[54570.002152][T772636] R10: 0000000080000000 R11: 0000000000000001 R12: 0000000000000000
[54570.002684][T772636] R13: ffff88801d6a07da R14: 0000000000000000 R15: 0000000000000001
[54570.004825][T772636] FS: 00007fee0aee1700(0000) GS:ffff88802ca00000(0000) knlGS:000000000
[54570.005445][T772636] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[54570.005893][T772636] CR2: 00007ffe793b19f0 CR3: 000000002130a000 CR4: 00000000000006f0
[54570.006430][T772636] Call Trace:
[54570.006660][T772636] <TASK>
[54570.006871][T772636] ? show_regs+0x96/0xa0
[54570.007197][T772636] ? __warn+0xe6/0x390
[54570.007506][T772636] ? cec_claim_log_addrs+0x29b/0x7c0
[54570.007875][T772636] ? report_bug+0x2dd/0x500
[54570.008203][T772636] ? cec_claim_log_addrs+0x29b/0x7c0
[54570.008573][T772636] ? handle_bug+0x99/0x120
[54570.008891][T772636] ? exc_invalid_op+0x36/0x80
[54570.009220][T772636] ? asm_exc_invalid_op+0x1a/0x20
[54570.009584][T772636] ? __wake_up_klogd.part.0+0x99/0xf0
[54570.009962][T772636] ? cec_claim_log_addrs+0x29a/0x7c0
[54570.010344][T772636] ? cec_claim_log_addrs+0x29b/0x7c0
[54570.010718][T772636] ? cec_adap_enable+0x534/0xbd0
[54570.011065][T772636] __cec_s_log_addrs+0xdfc/0x16e0
[54570.011437][T772636] cec_ioctl+0x1e7c/0x2690
[54570.011778][T772636] ? cec_release+0xbb0/0xbb0
[54570.012107][T772636] ? tomoyo_execute_permission+0x4a0/0x4a0
[54570.012520][T772636] ? __sanitizer_cov_trace_switch+0x54/0x90
[54570.012938][T772636] ? do_vfs_ioctl+0x138/0x16c0
[54570.013493][T772636] ? vfs_fileattr_set+0xc40/0xc40
[54570.013954][T772636] ? lock_downgrade+0x6a0/0x6a0
[54570.014422][T772636] ? bpf_lsm_file_ioctl+0x9/0x10
[54570.014791][T772636] ? cec_release+0xbb0/0xbb0
[54570.015117][T772636] __x64_sys_ioctl+0x19d/0x210
[54570.015466][T772636] do_syscall_64+0xd2/0x250
[54570.015785][T772636] entry_SYSCALL_64_after_hwframe+0x63/0x6b
[54570.016191][T772636] RIP: 0033:0x7fee0affaf29
[54570.016502][T772636] Code: 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 488
[54570.017779][T772636] RSP: 002b:00007fee0aee0e98 EFLAGS: 00000202 ORIG_RAX: 000000000000000
[54570.018343][T772636] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fee0affaf29
[54570.018872][T772636] RDX: 0000000020000680 RSI: 00000000c05c6104 RDI: 0000000000000004
[54570.019411][T772636] RBP: 00007fee0aee0ec0 R08: 0000000000000000 R09: 0000000000000000
[54570.019941][T772636] R10: 0000000000000000 R11: 0000000000000202 R12: 00007ffe792f9dce
[54570.020475][T772636] R13: 00007ffe792f9dcf R14: 00007fee0aee0fc0 R15: 0000000000022000
[54570.021013][T772636] </TASK>
[54570.021234][T772636] Kernel panic - not syncing: kernel: panic_on_warn set ...
[54570.021720][T772636] CPU: 0 PID: 772636 Comm: exe Not tainted 6.8.0-rc1-00169-gecb1b8288d5
[54570.022329][T772636] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-14
[54570.022956][T772636] Call Trace:
[54570.023192][T772636] <TASK>
[54570.023412][T772636] dump_stack_lvl+0xd9/0x150
[54570.023741][T772636] panic+0x6b9/0x760
[54570.024022][T772636] ? panic_smp_self_stop+0xa0/0xa0
[54570.024388][T772636] ? check_panic_on_warn+0x1f/0xc0
[54570.024746][T772636] ? cec_claim_log_addrs+0x29b/0x7c0
[54570.025111][T772636] check_panic_on_warn+0xb1/0xc0
[54570.025459][T772636] __warn+0xf2/0x390
[54570.025740][T772636] ? cec_claim_log_addrs+0x29b/0x7c0
[54570.026109][T772636] report_bug+0x2dd/0x500
[54570.026418][T772636] ? cec_claim_log_addrs+0x29b/0x7c0
[54570.026788][T772636] handle_bug+0x99/0x120
[54570.027085][T772636] exc_invalid_op+0x36/0x80
[54570.027408][T772636] asm_exc_invalid_op+0x1a/0x20
[54570.027748][T772636] RIP: 0010:cec_claim_log_addrs+0x29b/0x7c0
[54570.028154][T772636] Code: 7c 08 84 d2 0f 85 50 04 00 00 44 8b 25 ee 33 9f 0b 31 ff 44 89f
[54570.029431][T772636] RSP: 0018:ffffc90002117b30 EFLAGS: 00010293
[54570.029847][T772636] RAX: 0000000000000000 RBX: ffff88801d6a0000 RCX: ffffffff816a1959
[54570.030380][T772636] RDX: ffff888028e4b900 RSI: ffffffff8710b1ca RDI: 0000000000000005
[54570.030907][T772636] RBP: ffff88801d6a0638 R08: 0000000000000005 R09: 0000000000000000
[54570.031443][T772636] R10: 0000000080000000 R11: 0000000000000001 R12: 0000000000000000
[54570.031972][T772636] R13: ffff88801d6a07da R14: 0000000000000000 R15: 0000000000000001
[54570.032507][T772636] ? __wake_up_klogd.part.0+0x99/0xf0
[54570.032896][T772636] ? cec_claim_log_addrs+0x29a/0x7c0
[54570.033271][T772636] ? cec_adap_enable+0x534/0xbd0
[54570.033620][T772636] __cec_s_log_addrs+0xdfc/0x16e0
[54570.033978][T772636] cec_ioctl+0x1e7c/0x2690
[54570.034296][T772636] ? cec_release+0xbb0/0xbb0
[54570.034623][T772636] ? tomoyo_execute_permission+0x4a0/0x4a0
[54570.035030][T772636] ? __sanitizer_cov_trace_switch+0x54/0x90
[54570.035447][T772636] ? do_vfs_ioctl+0x138/0x16c0
[54570.035782][T772636] ? vfs_fileattr_set+0xc40/0xc40
[54570.036138][T772636] ? lock_downgrade+0x6a0/0x6a0
[54570.036487][T772636] ? bpf_lsm_file_ioctl+0x9/0x10
[54570.036835][T772636] ? cec_release+0xbb0/0xbb0
[54570.037159][T772636] __x64_sys_ioctl+0x19d/0x210
[54570.037497][T772636] do_syscall_64+0xd2/0x250
[54570.037817][T772636] entry_SYSCALL_64_after_hwframe+0x63/0x6b
```


I will collect the programs to trigger another 2 warnings and send you soon.


Best,
Chenyuan


On 2/12/24, 8:42 AM, "Hans Verkuil" <hverkuil-cisco@xs4all.nl <mailto:hverkuil-cisco@xs4all.nl> <mailto:hverkuil-cisco@xs4all.nl <mailto:hverkuil-cisco@xs4all.nl>>> wrote:




Hi Chenyuan,




On 30/01/2024 15:35, Hans Verkuil wrote:
> On 29/01/2024 04:03, Yang, Chenyuan wrote:
>> Hi Hans,
>>
>> Thanks a lot for this new patch!
>>
>> After applying this new patch in the latest kernel (hash: ecb1b8288dc7ccbdcb3b9df005fa1c0e0c0388a7) and fuzzing with Syzkaller, it seems that the hang still exists.
>> To help you better debug it, I attached the covered lines for the fuzz testing and the output of `git diff`. Hope this could help you.
>>
>> By the way, the syscall descriptions for CEC have been merged into the Syzkaller mainstream: https://urldefense.com/v3/__https://github.com/google/syzkaller/blob/master/sys/linux/dev_cec.txt__;!!DZ3fjg!8zd76_aCk9k_5Rn-mW78tk9IyhZUYovPw2SF9v6Pd5Tof8hm8qocM_NFBwbt0oRdAIH5uE8Ql8ysaoTJrMsn-dbvM9Xwwoo$ <https://urldefense.com/v3/__https://github.com/google/syzkaller/blob/master/sys/linux/dev_cec.txt__;!!DZ3fjg!8zd76_aCk9k_5Rn-mW78tk9IyhZUYovPw2SF9v6Pd5Tof8hm8qocM_NFBwbt0oRdAIH5uE8Ql8ysaoTJrMsn-dbvM9Xwwoo$> <https://urldefense.com/v3/__https://github.com/google/syzkaller/blob/master/sys/linux/dev_cec.txt__;!!DZ3fjg!8zd76_aCk9k_5Rn-mW78tk9IyhZUYovPw2SF9v6Pd5Tof8hm8qocM_NFBwbt0oRdAIH5uE8Ql8ysaoTJrMsn-dbvM9Xwwoo$ <https://urldefense.com/v3/__https://github.com/google/syzkaller/blob/master/sys/linux/dev_cec.txt__;!!DZ3fjg!8zd76_aCk9k_5Rn-mW78tk9IyhZUYovPw2SF9v6Pd5Tof8hm8qocM_NFBwbt0oRdAIH5uE8Ql8ysaoTJrMsn-dbvM9Xwwoo$>> .


>>
>> Let me know if you need further information.
>>
>> Best,
>> Chenyuan
> 
> Here is another patch. This now time outs on all wait_for_completion calls
> and reports a WARN_ON and shows additional info. Hopefully this will give me
> better insight into what is going on.
> 
> Unfortunately I was unable to reproduce this issue on my VM, so I have to
> rely on you to run the test.




Did you have time to run the test with this patch? It would be very useful to
see the results.




Regards,




Hans




> 
> Regards,
> 
> Hans
> 
> [PATCH] Test
> 
> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl <mailto:hverkuil-cisco@xs4all.nl> <mailto:hverkuil-cisco@xs4all.nl <mailto:hverkuil-cisco@xs4all.nl>>>
> ---
> diff --git a/drivers/media/cec/core/cec-adap.c b/drivers/media/cec/core/cec-adap.c
> index 5741adf09a2e..b1951eb7f5bd 100644
> --- a/drivers/media/cec/core/cec-adap.c
> +++ b/drivers/media/cec/core/cec-adap.c
> @@ -935,9 +935,12 @@ int cec_transmit_msg_fh(struct cec_adapter *adap, struct cec_msg *msg,
> * Release the lock and wait, retake the lock afterwards.
> */
> mutex_unlock(&adap->lock);
> - wait_for_completion_killable(&data->c);
> - if (!data->completed)
> - cancel_delayed_work_sync(&data->work);
> + if (WARN_ON(wait_for_completion_killable_timeout(&data->c, msecs_to_jiffies(adap->xfer_timeout_ms + 1000)) <= 0)) {
> + dprintk(0, "wfc1: %px %d%d%d%d %x\n", adap->kthread_config,
> + adap->is_configuring, adap->is_configured,
> + adap->is_enabled, adap->must_reconfigure, adap->phys_addr);
> + }
> + cancel_delayed_work_sync(&data->work);
> mutex_lock(&adap->lock);
> 
> /* Cancel the transmit if it was interrupted */
> @@ -1563,10 +1566,12 @@ static int cec_config_thread_func(void *arg)
> cec_transmit_msg_fh(adap, &msg, NULL, false);
> }
> }
> + mutex_unlock(&adap->lock);
> + call_void_op(adap, configured);
> + mutex_lock(&adap->lock);
> adap->kthread_config = NULL;
> complete(&adap->config_completion);
> mutex_unlock(&adap->lock);
> - call_void_op(adap, configured);
> return 0;
> 
> unconfigure:
> @@ -1592,6 +1597,17 @@ static void cec_claim_log_addrs(struct cec_adapter *adap, bool block)
> if (WARN_ON(adap->is_configuring || adap->is_configured))
> return;
> 
> + if (adap->kthread_config) {
> + mutex_unlock(&adap->lock);
> +// wait_for_completion(&adap->config_completion);
> + if (WARN_ON(wait_for_completion_killable_timeout(&adap->config_completion, msecs_to_jiffies(10000)) <= 0)) {
> + dprintk(0, "wfc2: %px %d%d%d%d %x\n", adap->kthread_config,
> + adap->is_configuring, adap->is_configured,
> + adap->is_enabled, adap->must_reconfigure, adap->phys_addr);
> + }
> + mutex_lock(&adap->lock);
> + }
> +
> init_completion(&adap->config_completion);
> 
> /* Ready to kick off the thread */
> @@ -1599,11 +1615,17 @@ static void cec_claim_log_addrs(struct cec_adapter *adap, bool block)
> adap->kthread_config = kthread_run(cec_config_thread_func, adap,
> "ceccfg-%s", adap->name);
> if (IS_ERR(adap->kthread_config)) {
> - adap->kthread_config = NULL;
> adap->is_configuring = false;
> + adap->kthread_config = NULL;
> } else if (block) {
> mutex_unlock(&adap->lock);
> - wait_for_completion(&adap->config_completion);
> + //wait_for_completion(&adap->config_completion);
> + if (WARN_ON(wait_for_completion_killable_timeout(&adap->config_completion, msecs_to_jiffies(10000)) <= 0)) {
> + dprintk(0, "wfc3: %px %d%d%d%d %x\n", adap->kthread_config,
> + adap->is_configuring, adap->is_configured,
> + adap->is_enabled, adap->must_reconfigure, adap->phys_addr);
> +
> + }
> mutex_lock(&adap->lock);
> }
> }
> diff --git a/drivers/media/cec/core/cec-api.c b/drivers/media/cec/core/cec-api.c
> index 67dc79ef1705..d64bb716f9c6 100644
> --- a/drivers/media/cec/core/cec-api.c
> +++ b/drivers/media/cec/core/cec-api.c
> @@ -664,6 +664,8 @@ static int cec_release(struct inode *inode, struct file *filp)
> list_del_init(&data->xfer_list);
> }
> mutex_unlock(&adap->lock);
> +
> + mutex_lock(&fh->lock);
> while (!list_empty(&fh->msgs)) {
> struct cec_msg_entry *entry =
> list_first_entry(&fh->msgs, struct cec_msg_entry, list);
> @@ -681,6 +683,7 @@ static int cec_release(struct inode *inode, struct file *filp)
> kfree(entry);
> }
> }
> + mutex_unlock(&fh->lock);
> kfree(fh);
> 
> cec_put_device(devnode);
> 










-- 
You received this message because you are subscribed to a topic in the Google Groups "syzkaller" group.
To unsubscribe from this topic, visit https://urldefense.com/v3/__https://groups.google.com/d/topic/syzkaller/wAHwQl5L8xk/unsubscribe__;!!DZ3fjg!6Zy8Roz73ycXIsgxej-lC_SC2_I1wXfZiXEsWChUX398JijiXc0iDFWD0EKyKx-ZrtWsc-zeTKq7SfvIzA$ <https://urldefense.com/v3/__https://groups.google.com/d/topic/syzkaller/wAHwQl5L8xk/unsubscribe__;!!DZ3fjg!6Zy8Roz73ycXIsgxej-lC_SC2_I1wXfZiXEsWChUX398JijiXc0iDFWD0EKyKx-ZrtWsc-zeTKq7SfvIzA$> .
To unsubscribe from this group and all its topics, send an email to syzkaller+unsubscribe@googlegroups.com <mailto:syzkaller+unsubscribe@googlegroups.com>.
To view this discussion on the web visit https://urldefense.com/v3/__https://groups.google.com/d/msgid/syzkaller/F8D4A291-8CFB-4A25-B296-3CA07B56F459 <https://urldefense.com/v3/__https://groups.google.com/d/msgid/syzkaller/F8D4A291-8CFB-4A25-B296-3CA07B56F459>*40illinois.edu__;JQ!!DZ3fjg!6Zy8Roz73ycXIsgxej-lC_SC2_I1wXfZiXEsWChUX398JijiXc0iDFWD0EKyKx-ZrtWsc-zeTKpauJqakQ$ .




[-- Attachment #2: cec-warn-1.c --]
[-- Type: application/octet-stream, Size: 8138 bytes --]

// autogenerated by syzkaller (https://github.com/google/syzkaller)

#define _GNU_SOURCE 

#include <dirent.h>
#include <endian.h>
#include <errno.h>
#include <fcntl.h>
#include <pthread.h>
#include <signal.h>
#include <stdarg.h>
#include <stdbool.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/prctl.h>
#include <sys/stat.h>
#include <sys/syscall.h>
#include <sys/types.h>
#include <sys/wait.h>
#include <time.h>
#include <unistd.h>

#include <linux/futex.h>

static unsigned long long procid;

static void sleep_ms(uint64_t ms)
{
	usleep(ms * 1000);
}

static uint64_t current_time_ms(void)
{
	struct timespec ts;
	if (clock_gettime(CLOCK_MONOTONIC, &ts))
	exit(1);
	return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000;
}

static void thread_start(void* (*fn)(void*), void* arg)
{
	pthread_t th;
	pthread_attr_t attr;
	pthread_attr_init(&attr);
	pthread_attr_setstacksize(&attr, 128 << 10);
	int i = 0;
	for (; i < 100; i++) {
		if (pthread_create(&th, &attr, fn, arg) == 0) {
			pthread_attr_destroy(&attr);
			return;
		}
		if (errno == EAGAIN) {
			usleep(50);
			continue;
		}
		break;
	}
	exit(1);
}

typedef struct {
	int state;
} event_t;

static void event_init(event_t* ev)
{
	ev->state = 0;
}

static void event_reset(event_t* ev)
{
	ev->state = 0;
}

static void event_set(event_t* ev)
{
	if (ev->state)
	exit(1);
	__atomic_store_n(&ev->state, 1, __ATOMIC_RELEASE);
	syscall(SYS_futex, &ev->state, FUTEX_WAKE | FUTEX_PRIVATE_FLAG, 1000000);
}

static void event_wait(event_t* ev)
{
	while (!__atomic_load_n(&ev->state, __ATOMIC_ACQUIRE))
		syscall(SYS_futex, &ev->state, FUTEX_WAIT | FUTEX_PRIVATE_FLAG, 0, 0);
}

static int event_isset(event_t* ev)
{
	return __atomic_load_n(&ev->state, __ATOMIC_ACQUIRE);
}

static int event_timedwait(event_t* ev, uint64_t timeout)
{
	uint64_t start = current_time_ms();
	uint64_t now = start;
	for (;;) {
		uint64_t remain = timeout - (now - start);
		struct timespec ts;
		ts.tv_sec = remain / 1000;
		ts.tv_nsec = (remain % 1000) * 1000 * 1000;
		syscall(SYS_futex, &ev->state, FUTEX_WAIT | FUTEX_PRIVATE_FLAG, 0, &ts);
		if (__atomic_load_n(&ev->state, __ATOMIC_ACQUIRE))
			return 1;
		now = current_time_ms();
		if (now - start > timeout)
			return 0;
	}
}

static bool write_file(const char* file, const char* what, ...)
{
	char buf[1024];
	va_list args;
	va_start(args, what);
	vsnprintf(buf, sizeof(buf), what, args);
	va_end(args);
	buf[sizeof(buf) - 1] = 0;
	int len = strlen(buf);
	int fd = open(file, O_WRONLY | O_CLOEXEC);
	if (fd == -1)
		return false;
	if (write(fd, buf, len) != len) {
		int err = errno;
		close(fd);
		errno = err;
		return false;
	}
	close(fd);
	return true;
}

static long syz_open_dev(volatile long a0, volatile long a1, volatile long a2)
{
	if (a0 == 0xc || a0 == 0xb) {
		char buf[128];
		sprintf(buf, "/dev/%s/%d:%d", a0 == 0xc ? "char" : "block", (uint8_t)a1, (uint8_t)a2);
		return open(buf, O_RDWR, 0);
	} else {
		char buf[1024];
		char* hash;
		strncpy(buf, (char*)a0, sizeof(buf) - 1);
		buf[sizeof(buf) - 1] = 0;
		while ((hash = strchr(buf, '#'))) {
			*hash = '0' + (char)(a1 % 10);
			a1 /= 10;
		}
		return open(buf, a2, 0);
	}
}

static void kill_and_wait(int pid, int* status)
{
	kill(-pid, SIGKILL);
	kill(pid, SIGKILL);
	for (int i = 0; i < 100; i++) {
		if (waitpid(-1, status, WNOHANG | __WALL) == pid)
			return;
		usleep(1000);
	}
	DIR* dir = opendir("/sys/fs/fuse/connections");
	if (dir) {
		for (;;) {
			struct dirent* ent = readdir(dir);
			if (!ent)
				break;
			if (strcmp(ent->d_name, ".") == 0 || strcmp(ent->d_name, "..") == 0)
				continue;
			char abort[300];
			snprintf(abort, sizeof(abort), "/sys/fs/fuse/connections/%s/abort", ent->d_name);
			int fd = open(abort, O_WRONLY);
			if (fd == -1) {
				continue;
			}
			if (write(fd, abort, 1) < 0) {
			}
			close(fd);
		}
		closedir(dir);
	} else {
	}
	while (waitpid(-1, status, __WALL) != pid) {
	}
}

static void setup_test()
{
	prctl(PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0);
	setpgrp();
	write_file("/proc/self/oom_score_adj", "1000");
}

struct thread_t {
	int created, call;
	event_t ready, done;
};

static struct thread_t threads[16];
static void execute_call(int call);
static int running;

static void* thr(void* arg)
{
	struct thread_t* th = (struct thread_t*)arg;
	for (;;) {
		event_wait(&th->ready);
		event_reset(&th->ready);
		execute_call(th->call);
		__atomic_fetch_sub(&running, 1, __ATOMIC_RELAXED);
		event_set(&th->done);
	}
	return 0;
}

static void execute_one(void)
{
	int i, call, thread;
	for (call = 0; call < 4; call++) {
		for (thread = 0; thread < (int)(sizeof(threads) / sizeof(threads[0])); thread++) {
			struct thread_t* th = &threads[thread];
			if (!th->created) {
				th->created = 1;
				event_init(&th->ready);
				event_init(&th->done);
				event_set(&th->done);
				thread_start(thr, th);
			}
			if (!event_isset(&th->done))
				continue;
			event_reset(&th->done);
			th->call = call;
			__atomic_fetch_add(&running, 1, __ATOMIC_RELAXED);
			event_set(&th->ready);
			event_timedwait(&th->done, 50);
			break;
		}
	}
	for (i = 0; i < 100 && __atomic_load_n(&running, __ATOMIC_RELAXED); i++)
		sleep_ms(1);
}

static void execute_one(void);

#define WAIT_FLAGS __WALL

static void loop(void)
{
	int iter = 0;
	for (;; iter++) {
		int pid = fork();
		if (pid < 0)
	exit(1);
		if (pid == 0) {
			setup_test();
			execute_one();
			exit(0);
		}
		int status = 0;
		uint64_t start = current_time_ms();
		for (;;) {
			if (waitpid(-1, &status, WNOHANG | WAIT_FLAGS) == pid)
				break;
			sleep_ms(1);
			if (current_time_ms() - start < 5000)
				continue;
			kill_and_wait(pid, &status);
			break;
		}
	}
}

uint64_t r[2] = {0xffffffffffffffff, 0xffffffffffffffff};

void execute_call(int call)
{
		intptr_t res = 0;
	switch (call) {
	case 0:
memcpy((void*)0x20000140, "/dev/cec#\000", 10);
		res = -1;
res = syz_open_dev(/*dev=*/0x20000140, /*id=*/0 + procid*1, /*flags=*/0);
		if (res != -1)
				r[0] = res;
		break;
	case 1:
*(uint64_t*)0x20000200 = 0;
*(uint64_t*)0x20000208 = 0x10001;
*(uint32_t*)0x20000210 = 9;
*(uint32_t*)0x20000214 = 0x80000001;
*(uint32_t*)0x20000218 = 0xffff;
*(uint32_t*)0x2000021c = 0xd3a6383;
memcpy((void*)0x20000220, "\xb0\x37\x80\xe7\x3a\x10\x88\x3f\x6f\x4e\x5b\x71\x69\x6c\xff\xfb", 16);
*(uint8_t*)0x20000230 = 3;
*(uint8_t*)0x20000231 = 0x3f;
*(uint8_t*)0x20000232 = 6;
*(uint8_t*)0x20000233 = 0xa0;
*(uint8_t*)0x20000234 = 8;
*(uint8_t*)0x20000235 = 1;
*(uint8_t*)0x20000236 = 1;
		syscall(__NR_ioctl, /*fd=*/r[0], /*cmd=*/0xc0386105, /*arg=*/0x20000200ul);
		break;
	case 2:
memcpy((void*)0x20000000, "/dev/cec#\000", 10);
		res = -1;
res = syz_open_dev(/*dev=*/0x20000000, /*id=*/0 + procid*1, /*flags=*/0);
		if (res != -1)
				r[1] = res;
		break;
	case 3:
memcpy((void*)0x20000240, "\xed\x95\xe5\x72", 4);
*(uint16_t*)0x20000244 = 0x7fff;
*(uint8_t*)0x20000246 = 6;
*(uint8_t*)0x20000247 = 0xb6;
*(uint32_t*)0x20000248 = 7;
*(uint32_t*)0x2000024c = 0xffff;
memcpy((void*)0x20000250, "\xad\x79\x7c\xea\x67\xb7\x7d\x69\xa9\x6b\x2d\x27\x36\xf5\x94", 15);
memcpy((void*)0x2000025f, "\xc7\x8f\xb0\x97", 4);
memcpy((void*)0x20000263, "\x6f\xf7\xda\x47", 4);
memcpy((void*)0x20000267, "\x62\x10\x53\x1d", 4);
memcpy((void*)0x2000026b, "\x24\x30\x00\x24\x5f\x24\x4e\xd3\xc9\x82\x4b\x4e", 12);
memcpy((void*)0x20000277, "\x1b\x08\x52\x86\xdb\x34\xc9\x0b\x15\x60\xc0\xb9", 12);
memcpy((void*)0x20000283, "\x0d\xc9\xfa\x2d\x07\x7a\x5a\x0c\xb4\x0b\x11\xaf", 12);
memcpy((void*)0x2000028f, "\x03\x7e\x04\x95\xb2\x1e\x40\xdd\x99\x8d\x32\x32", 12);
		syscall(__NR_ioctl, /*fd=*/r[1], /*cmd=*/0xc05c6104, /*arg=*/0x20000240ul);
		break;
	}

}
int main(void)
{
		syscall(__NR_mmap, /*addr=*/0x1ffff000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=*/0x32ul, /*fd=*/-1, /*offset=*/0ul);
	syscall(__NR_mmap, /*addr=*/0x20000000ul, /*len=*/0x1000000ul, /*prot=*/7ul, /*flags=*/0x32ul, /*fd=*/-1, /*offset=*/0ul);
	syscall(__NR_mmap, /*addr=*/0x21000000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=*/0x32ul, /*fd=*/-1, /*offset=*/0ul);
	for (procid = 0; procid < 8; procid++) {
		if (fork() == 0) {
			loop();
		}
	}
	sleep(1000000);
	return 0;
}

  reply	other threads:[~2024-02-13 16:46 UTC|newest]

Thread overview: 25+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2023-12-28  2:33 [Linux Kernel Bugs] KASAN: slab-use-after-free Read in cec_queue_msg_fh and 4 other crashes in the cec device (`cec_ioctl`) Yang, Chenyuan
2023-12-29  6:23 ` Dmitry Vyukov
     [not found] ` <SN6PR11MB345527101A2C8A1AC99B04B5FA712@SN6PR11MB3455.namprd11.prod.outlook.com>
2024-01-18  7:52   ` Hans Verkuil
2024-01-19  8:17 ` Hans Verkuil
2024-01-22 19:11   ` Yang, Chenyuan
2024-01-23  8:02     ` Hans Verkuil
2024-01-23 10:39       ` Hans Verkuil
2024-01-24 13:33   ` Yang, Chenyuan
2024-01-25 10:35     ` Hans Verkuil
2024-01-29  3:03   ` Yang, Chenyuan
2024-01-30 14:35     ` Hans Verkuil
2024-02-12 14:42       ` Hans Verkuil
2024-02-13 15:40         ` Yang, Chenyuan
2024-02-13 16:05           ` Yang, Chenyuan [this message]
2024-02-23 14:44           ` Hans Verkuil
     [not found]             ` <PH7PR11MB5768B0BC3C042A6EA4EC1EF0A0542@PH7PR11MB5768.namprd11.prod.outlook.com>
2024-02-26 12:27               ` Yang, Chenyuan
2024-04-19 14:51                 ` Takashi Iwai
2024-04-22 12:14                   ` Hans Verkuil
2024-04-22 19:30                     ` Takashi Iwai
2024-04-22 15:04                 ` Hans Verkuil
2024-04-22 18:54                   ` Yang, Chenyuan
2024-04-22 20:57                     ` Hans Verkuil
2024-04-29 15:42                       ` Yang, Chenyuan
2024-04-30 10:26                         ` Hans Verkuil
2024-04-30 17:06                           ` Yang, Chenyuan

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=0C7B75A2-B4C8-43CB-A57A-910B3674E787@illinois.edu \
    --to=cy54@illinois.edu \
    --cc=hverkuil-cisco@xs4all.nl \
    --cc=jani.nikula@intel.com \
    --cc=lingming@illinois.edu \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-media@vger.kernel.org \
    --cc=mchehab@kernel.org \
    --cc=syzkaller@googlegroups.com \
    --cc=zijie4@illinois.edu \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).