From: Benjamin Herrenschmidt <benh@kernel.crashing.org>
To: Linus Torvalds <torvalds@linux-foundation.org>,
syzbot <syzbot+db1637662f412ac0d556@syzkaller.appspotmail.com>,
Marcel Holtmann <marcel@holtmann.org>,
Johan Hedberg <johan.hedberg@gmail.com>,
"David S. Miller" <davem@davemloft.net>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
Linux Kernel Mailing List <linux-kernel@vger.kernel.org>,
Rafael Wysocki <rafael@kernel.org>,
syzkaller-bugs <syzkaller-bugs@googlegroups.com>,
Tejun Heo <tj@kernel.org>,
linux-bluetooth <linux-bluetooth@vger.kernel.org>
Subject: Re: general protection fault in kernfs_add_one
Date: Wed, 20 Nov 2019 15:03:43 +1100 [thread overview]
Message-ID: <14e1a22937ce5a54d94dab04a103e159215fb654.camel@kernel.crashing.org> (raw)
In-Reply-To: <CAHk-=wjg0JXgwb6rkFK0q_JvW7YdGpiPtMVWe=YhFK1y_2-F7Q@mail.gmail.com>
On Tue, 2019-11-19 at 11:00 -0800, Linus Torvalds wrote:
> So looking at the decode, as usual the noise generated by KASAN isn't
> being very helpful, but it does look like at least one of the reports
> (I picked 5.2 because I don't care about 4.19 etc) is because
> 'kernfs_root(kn) is NULL in kernfs_add_one().
>
> Looking at the reports, every single one seems to have a call chain
> that comes from vhci_write() -> vhci_get_user() ->
> vhci_create_device() -> __vhci_create_device() -> hci_register_dev()
> -> device_add() -> kobject_add().
>
> (In this case, "every single one" is by looking at the last 10
> reports
> sorted by date, it wasn't exhaustive).
>
> The way it got into 'write()' can be a bit varied (splice, write,
> whatever).
>
> That makes me think it's bluetooth that is the problem, but it might
> be an effect of how syzbot groups the reports too, of course.
>
> Might the device have been added at the same time that the last
> previous device was removed, so that the parent was deleted as the
> new
> device was aded? I dunno. The repro seem to be a repeated "open
> /dev/vhci, write two random bytes to it"
>
> Or might it be some "it happens after you've added enough devices
> that
> something overflows" issue?
>
> Adding bluetooth people to the cc.
Could this be what was fixed by:
ac43432cb1f5c2950408534987e57c2071e24d8f
("driver core: Fix use-after-free and double free on glue directory")
Which went into 5.3 afaik ?
Cheers,
Ben.
> Linus
>
> On Mon, Nov 18, 2019 at 10:27 PM syzbot
> <syzbot+db1637662f412ac0d556@syzkaller.appspotmail.com> wrote:
> >
> > syzbot has bisected this bug to:
> >
> > commit 726e41097920a73e4c7c33385dcc0debb1281e18
> > Author: Benjamin Herrenschmidt <benh@kernel.crashing.org>
> > Date: Tue Jul 10 00:29:10 2018 +0000
> >
> > drivers: core: Remove glue dirs from sysfs earlier
> >
> > bisection log:
> > https://syzkaller.appspot.com/x/bisect.txt?x=168e1012e00000
> > start commit: 5e335542 Merge branch 'for-linus' of
> > git://git.kernel.org/..
> > git tree: upstream
> > final crash:
> > https://syzkaller.appspot.com/x/report.txt?x=158e1012e00000
> > console output:
> > https://syzkaller.appspot.com/x/log.txt?x=118e1012e00000
> > kernel config:
> > https://syzkaller.appspot.com/x/.config?x=9917ff4b798e1a1e
> > dashboard link:
> > https://syzkaller.appspot.com/bug?extid=db1637662f412ac0d556
> > syz repro:
> > https://syzkaller.appspot.com/x/repro.syz?x=10a66c11400000
> > C reproducer:
> > https://syzkaller.appspot.com/x/repro.c?x=1346c771400000
> >
> > Reported-by: syzbot+db1637662f412ac0d556@syzkaller.appspotmail.com
> > Fixes: 726e41097920 ("drivers: core: Remove glue dirs from sysfs
> > earlier")
> >
> > For information about bisection process see:
> > https://goo.gl/tpsmEJ#bisection
next prev parent reply other threads:[~2019-11-20 4:04 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-09-16 15:33 general protection fault in kernfs_add_one syzbot
2019-11-19 6:27 ` syzbot
2019-11-19 19:00 ` Linus Torvalds
2019-11-19 23:03 ` Marcel Holtmann
2019-11-20 4:03 ` Benjamin Herrenschmidt [this message]
2019-11-20 16:54 ` Linus Torvalds
2019-11-22 8:10 ` Dmitry Vyukov
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=14e1a22937ce5a54d94dab04a103e159215fb654.camel@kernel.crashing.org \
--to=benh@kernel.crashing.org \
--cc=davem@davemloft.net \
--cc=gregkh@linuxfoundation.org \
--cc=johan.hedberg@gmail.com \
--cc=linux-bluetooth@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=marcel@holtmann.org \
--cc=rafael@kernel.org \
--cc=syzbot+db1637662f412ac0d556@syzkaller.appspotmail.com \
--cc=syzkaller-bugs@googlegroups.com \
--cc=tj@kernel.org \
--cc=torvalds@linux-foundation.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).