From: "Yang, Chenyuan" <cy54@illinois.edu>
To: Hans Verkuil <hverkuil-cisco@xs4all.nl>,
"linux-media@vger.kernel.org" <linux-media@vger.kernel.org>,
"linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>
Cc: "jani.nikula@intel.com" <jani.nikula@intel.com>,
"syzkaller@googlegroups.com" <syzkaller@googlegroups.com>,
"mchehab@kernel.org" <mchehab@kernel.org>,
"Zhao, Zijie" <zijie4@illinois.edu>,
"Zhang, Lingming" <lingming@illinois.edu>
Subject: Re: [Linux Kernel Bugs] KASAN: slab-use-after-free Read in cec_queue_msg_fh and 4 other crashes in the cec device (`cec_ioctl`)
Date: Tue, 30 Apr 2024 17:06:52 +0000 [thread overview]
Message-ID: <7E76BF48-21F3-4C96-B6A7-C0E9D107D61F@illinois.edu> (raw)
In-Reply-To: <ace1b749-9a4d-4c68-b5a7-530e0d3ff504@xs4all.nl>
Hi Hans,
Thanks so much for your prompt response!
This patch does fix the error and there is no "transmit timed out" message anymore!
(Sorry I replied this twice since I forgot to turn on the plain text mode in my first reply.)
Best,
Chenyuan
On 4/30/24, 3:26 AM, "syzkaller@googlegroups.com <mailto:syzkaller@googlegroups.com> on behalf of Hans Verkuil" <syzkaller@googlegroups.com <mailto:syzkaller@googlegroups.com> on behalf of hverkuil-cisco@xs4all.nl <mailto:hverkuil-cisco@xs4all.nl>> wrote:
Hi Chenyuan,
On 29/04/2024 17:42, Yang, Chenyuan wrote:
> Hi Hans,
>
> Here is my QEMU booting command:
>
> ```
> qemu-system-x86_64 \
> -m 2G \
> -smp 2 \
> -kernel linux/arch/x86/boot/bzImage \
> -append "console=ttyS0 root=/dev/sda earlyprintk=serial net.ifnames=0" \
> -drive file=image/bullseye-qemu.img,format=raw \
> -net user,host=10.0.2.10,hostfwd=tcp:127.0.0.1:10021-:22 \
> -net nic,model=e1000 \
> -enable-kvm \
> -nographic \
> -pidfile vm.pi
> ```
>
> Plus, here is the config of vivid from my linux kernel building config:
>
> ```
> CONFIG_VIDEO_VIVID=y
> CONFIG_VIDEO_VIVID_CEC=y
> CONFIG_VIDEO_VIVID_MAX_DEVS=64
>
> CONFIG_CMDLINE="... vivid.n_devs=16 vivid.multiplanar=1,2,1,2,1,2,1,2,1,2,1,2,1,2,1,2 ..."
>
> # Here is the full
> CONFIG_CMDLINE="earlyprintk=serial net.ifnames=0 sysctl.kernel.hung_task_all_cpu_backtrace=1 ima_policy=tcb nf-conntrack-ftp.ports=20000 nf-conntrack-tftp.ports=20000 nf-conntrack-sip.ports=20000 nf-conntrack-irc.ports=20000 nf-conntrack-sane.ports=20000 binder.debug_mask=0 rcupdate.rcu_expedited=1 rcupdate.rcu_cpu_stall_cputime=1 no_hash_pointers page_owner=on sysctl.vm.nr_hugepages=4 sysctl.vm.nr_overcommit_hugepages=4 secretmem.enable=1 sysctl.max_rcu_stall_to_panic=1 msr.allow_writes=off coredump_filter=0xffff root=/dev/sda console=ttyS0 vsyscall=native numa=fake=2 kvm-intel.nested=1 spec_store_bypass_disable=prctl nopcid vivid.n_devs=16 vivid.multiplanar=1,2,1,2,1,2,1,2,1,2,1,2,1,2,1,2 netrom.nr_ndevs=16 rose.rose_ndevs=16 smp.csd_lock_timeout=100000 watchdog_thresh=55 workqueue.watchdog_thresh=140 sysctl.net.core.netdev_unregister_timeout_secs=140 dummy_hcd.num=8 kmsan.panic=1"
> ```
>
> Plus, I attached the current patch (git diff > patch).
>
> Let me know if you need any further information.
Ah, that was helpful. I also discovered that I had to run the reproducer as root,
that helped too :-)
Please add this patch on top of the diff you already have and try again.
The reproducer kills each forked process after 5 seconds from what I can
tell. That causes a driver wait call to return -ERESTARTSYS, and that corner
case was not handled correctly. It caused the harmless but confusing
"transmit timed out" message.
Regards,
Hans
---------------------------------------------------------------------
[PATCH] cec: core: avoid confusing "transmit timed out" message
If, when waiting for a transmit to finish, the wait is interrupted,
then you might get a "transmit timed out" message, even though the
transmit was interrupted and did not actually time out.
Set transmit_in_progress_aborted to true if the
wait_for_completion_killable() call was interrupted and ensure
that the transmit is properly marked as ABORTED.
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl <mailto:hverkuil-cisco@xs4all.nl>>
---
drivers/media/cec/core/cec-adap.c | 15 ++++++++++++++-
1 file changed, 14 insertions(+), 1 deletion(-)
diff --git a/drivers/media/cec/core/cec-adap.c b/drivers/media/cec/core/cec-adap.c
index a493cbce24567..da09834990b87 100644
--- a/drivers/media/cec/core/cec-adap.c
+++ b/drivers/media/cec/core/cec-adap.c
@@ -490,6 +490,15 @@ int cec_thread_func(void *_adap)
goto unlock;
}
+ if (adap->transmit_in_progress &&
+ adap->transmit_in_progress_aborted) {
+ if (adap->transmitting)
+ cec_data_cancel(adap->transmitting,
+ CEC_TX_STATUS_ABORTED, 0);
+ adap->transmit_in_progress = false;
+ adap->transmit_in_progress_aborted = false;
+ goto unlock;
+ }
if (adap->transmit_in_progress && timeout) {
/*
* If we timeout, then log that. Normally this does
@@ -771,6 +780,7 @@ int cec_transmit_msg_fh(struct cec_adapter *adap, struct cec_msg *msg,
{
struct cec_data *data;
bool is_raw = msg_is_raw(msg);
+ int err;
if (adap->devnode.unregistered)
return -ENODEV;
@@ -935,10 +945,13 @@ int cec_transmit_msg_fh(struct cec_adapter *adap, struct cec_msg *msg,
* Release the lock and wait, retake the lock afterwards.
*/
mutex_unlock(&adap->lock);
- wait_for_completion_killable(&data->c);
+ err = wait_for_completion_killable(&data->c);
cancel_delayed_work_sync(&data->work);
mutex_lock(&adap->lock);
+ if (err)
+ adap->transmit_in_progress_aborted = true;
+
/* Cancel the transmit if it was interrupted */
if (!data->completed) {
if (data->msg.tx_status & CEC_TX_STATUS_OK)
--
2.43.0
--
You received this message because you are subscribed to a topic in the Google Groups "syzkaller" group.
To unsubscribe from this topic, visit https://urldefense.com/v3/__https://groups.google.com/d/topic/syzkaller/wAHwQl5L8xk/unsubscribe__;!!DZ3fjg!8W78eOM9lWrX2meQEU5os0vIlxyVKxVHGsttosEVMN3HNoWfp9n_kub1WI_XpTPYsj1SwLCybP8mQ-3q4WrJ47GjS5r3Xco$ <https://urldefense.com/v3/__https://groups.google.com/d/topic/syzkaller/wAHwQl5L8xk/unsubscribe__;!!DZ3fjg!8W78eOM9lWrX2meQEU5os0vIlxyVKxVHGsttosEVMN3HNoWfp9n_kub1WI_XpTPYsj1SwLCybP8mQ-3q4WrJ47GjS5r3Xco$> .
To unsubscribe from this group and all its topics, send an email to syzkaller+unsubscribe@googlegroups.com <mailto:syzkaller+unsubscribe@googlegroups.com>.
To view this discussion on the web visit https://urldefense.com/v3/__https://groups.google.com/d/msgid/syzkaller/ace1b749-9a4d-4c68-b5a7-530e0d3ff504 <https://urldefense.com/v3/__https://groups.google.com/d/msgid/syzkaller/ace1b749-9a4d-4c68-b5a7-530e0d3ff504>*40xs4all.nl__;JQ!!DZ3fjg!8W78eOM9lWrX2meQEU5os0vIlxyVKxVHGsttosEVMN3HNoWfp9n_kub1WI_XpTPYsj1SwLCybP8mQ-3q4WrJ47GjaIH_GKw$ .
prev parent reply other threads:[~2024-04-30 17:48 UTC|newest]
Thread overview: 25+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-12-28 2:33 [Linux Kernel Bugs] KASAN: slab-use-after-free Read in cec_queue_msg_fh and 4 other crashes in the cec device (`cec_ioctl`) Yang, Chenyuan
2023-12-29 6:23 ` Dmitry Vyukov
[not found] ` <SN6PR11MB345527101A2C8A1AC99B04B5FA712@SN6PR11MB3455.namprd11.prod.outlook.com>
2024-01-18 7:52 ` Hans Verkuil
2024-01-19 8:17 ` Hans Verkuil
2024-01-22 19:11 ` Yang, Chenyuan
2024-01-23 8:02 ` Hans Verkuil
2024-01-23 10:39 ` Hans Verkuil
2024-01-24 13:33 ` Yang, Chenyuan
2024-01-25 10:35 ` Hans Verkuil
2024-01-29 3:03 ` Yang, Chenyuan
2024-01-30 14:35 ` Hans Verkuil
2024-02-12 14:42 ` Hans Verkuil
2024-02-13 15:40 ` Yang, Chenyuan
2024-02-13 16:05 ` Yang, Chenyuan
2024-02-23 14:44 ` Hans Verkuil
[not found] ` <PH7PR11MB5768B0BC3C042A6EA4EC1EF0A0542@PH7PR11MB5768.namprd11.prod.outlook.com>
2024-02-26 12:27 ` Yang, Chenyuan
2024-04-19 14:51 ` Takashi Iwai
2024-04-22 12:14 ` Hans Verkuil
2024-04-22 19:30 ` Takashi Iwai
2024-04-22 15:04 ` Hans Verkuil
2024-04-22 18:54 ` Yang, Chenyuan
2024-04-22 20:57 ` Hans Verkuil
2024-04-29 15:42 ` Yang, Chenyuan
2024-04-30 10:26 ` Hans Verkuil
2024-04-30 17:06 ` Yang, Chenyuan [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=7E76BF48-21F3-4C96-B6A7-C0E9D107D61F@illinois.edu \
--to=cy54@illinois.edu \
--cc=hverkuil-cisco@xs4all.nl \
--cc=jani.nikula@intel.com \
--cc=lingming@illinois.edu \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-media@vger.kernel.org \
--cc=mchehab@kernel.org \
--cc=syzkaller@googlegroups.com \
--cc=zijie4@illinois.edu \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).