general protection fault in kernfs_add_one

general protection fault in kernfs_add_one

[syzbot]

Hello,

syzbot found the following crash on:

HEAD commit:    5e335542de83 Merge branch 'for-linus' of git://git.kernel...
git tree:       upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=13a1f2ae400000
kernel config:  https://syzkaller.appspot.com/x/.config?x=9917ff4b798e1a1e
dashboard link: https://syzkaller.appspot.com/bug?extid=db1637662f412ac0d556
compiler:       gcc (GCC) 8.0.1 20180413 (experimental)
syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=10a66c11400000
C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=1346c771400000

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+db1637662f412ac0d556@syzkaller.appspotmail.com

kobject_add_internal failed for hci2 (error: -2 parent: bluetooth)
Bluetooth: Can't register HCI device
Bluetooth: Can't register HCI device
kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] PREEMPT SMP KASAN
kobject: 'hci5' (00000000943cb5fb): kobject_cleanup, parent           (null)
CPU: 0 PID: 6716 Comm: syz-executor469 Not tainted 4.19.0-rc3+ #9
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS  
Google 01/01/2011
RIP: 0010:kernfs_add_one+0x342/0x4d0 fs/kernfs/dir.c:812
Code: 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 49 01 00 00 48 b8 00 00 00 00  
00 fc ff df 4d 8b 6d 70 49 8d 7d 08 48 89 fa 48 c1 ea 03 <0f> b6 04 02 84  
c0 74 08 3c 03 0f 8e 16 01 00 00 45 8b 6d 08 31 ff
kobject: 'rfkill1319' (00000000969d6091): kobject_uevent_env
RSP: 0018:ffff8801bc5df588 EFLAGS: 00010202
RAX: dffffc0000000000 RBX: ffff8801ba043380 RCX: ffffffff87bea6d7
RDX: 0000000000000001 RSI: ffffffff81f7f9ca RDI: 0000000000000008
RBP: ffff8801bc5df5d0 R08: fffffbfff12d121d R09: fffffbfff12d121c
R10: fffffbfff12d121c R11: ffffffff896890e7 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
FS:  0000000001901880(0000) GS:ffff8801dae00000(0000) knlGS:0000000000000000
kobject: 'rfkill1320' (000000000f2f7b02): kobject_add_internal:  
parent: 'hci4', set: 'devices'
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f5e5ce5a000 CR3: 00000001bb73b000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
kobject: 'hci5' (00000000943cb5fb): calling ktype release
  kernfs_create_dir_ns+0xf6/0x160 fs/kernfs/dir.c:1031
  sysfs_create_dir_ns+0x19b/0x340 fs/sysfs/dir.c:58
kobject: 'rfkill1319' (00000000969d6091): fill_kobj_path: path  
= '/devices/virtual/bluetooth/hci2/rfkill1319'
  create_dir lib/kobject.c:88 [inline]
  kobject_add_internal+0x440/0xb60 lib/kobject.c:247
kobject: 'hci5': free name
  kobject_add_varg lib/kobject.c:382 [inline]
  kobject_add+0x13f/0x1b0 lib/kobject.c:426
kobject: 'rfkill1320' (000000000f2f7b02): kobject_uevent_env
  device_add+0x3e2/0x17f0 drivers/base/core.c:1879
kobject: 'rfkill1320' (000000000f2f7b02): fill_kobj_path: path  
= '/devices/virtual/bluetooth/hci4/rfkill1320'
kobject: 'rfkill1319' (00000000969d6091): kobject_cleanup, parent            
(null)
  hci_register_dev+0x3e6/0xb80 net/bluetooth/hci_core.c:3196
kobject: 'rfkill1320' (000000000f2f7b02): kobject_uevent_env
  __vhci_create_device+0x2c1/0x580 drivers/bluetooth/hci_vhci.c:139
kobject: 'hci1' (000000005b9ca8c2): kobject_add_internal:  
parent: 'bluetooth', set: 'devices'
  vhci_create_device drivers/bluetooth/hci_vhci.c:163 [inline]
  vhci_get_user drivers/bluetooth/hci_vhci.c:219 [inline]
  vhci_write+0x2de/0x470 drivers/bluetooth/hci_vhci.c:299
  call_write_iter include/linux/fs.h:1807 [inline]
  new_sync_write fs/read_write.c:474 [inline]
  __vfs_write+0x6b8/0x9f0 fs/read_write.c:487
kobject: 'rfkill1319' (00000000969d6091): calling ktype release
kobject: 'rfkill1320' (000000000f2f7b02): fill_kobj_path: path  
= '/devices/virtual/bluetooth/hci4/rfkill1320'
  vfs_write+0x1fc/0x560 fs/read_write.c:549
  ksys_write+0x101/0x260 fs/read_write.c:598
kobject: 'hci1' (000000005b9ca8c2): kobject_uevent_env
  __do_sys_write fs/read_write.c:610 [inline]
  __se_sys_write fs/read_write.c:607 [inline]
  __x64_sys_write+0x73/0xb0 fs/read_write.c:607
  do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290
kobject: 'hci1' (000000005b9ca8c2): fill_kobj_path: path  
= '/devices/virtual/bluetooth/hci1'
kobject: 'rfkill1319': free name
  entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x440e49
Code: e8 ac e8 ff ff 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7  
48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff  
ff 0f 83 0b 0a fc ff c3 66 2e 0f 1f 84 00 00 00 00
kobject: 'hci2' (00000000156e1c6f): kobject_uevent_env
RSP: 002b:00007fff32bcc918 EFLAGS: 00000213 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000440e49
RDX: 0000000000000002 RSI: 00000000200000c0 RDI: 0000000000000003
RBP: 0000000000000000 R08: 00000000004002c8 R09: 00000000004002c8
R10: 0000000001901880 R11: 0000000000000213 R12: 0000000000013465
kobject: 'rfkill1321' (00000000bd6cc24c): kobject_add_internal:  
parent: 'hci1', set: 'devices'
R13: 0000000000401d70 R14: 0000000000000000 R15: 0000000000000000
Modules linked in:
kobject: 'hci3' (00000000c8669077): kobject_add_internal:  
parent: 'bluetooth', set: 'devices'
kobject: 'hci2' (00000000156e1c6f): fill_kobj_path: path  
= '/devices/virtual/bluetooth/hci2'
kobject: 'hci5' (0000000076c884f7): kobject_add_internal:  
parent: 'bluetooth', set: 'devices'
kobject: 'hci2' (00000000156e1c6f): kobject_cleanup, parent           (null)
kobject: 'rfkill1321' (00000000bd6cc24c): kobject_uevent_env
kobject: 'hci2' (00000000156e1c6f): calling ktype release
kobject: 'hci5' (0000000076c884f7): kobject_uevent_env
kobject: 'hci2': free name
kobject: 'rfkill1321' (00000000bd6cc24c): fill_kobj_path: path  
= '/devices/virtual/bluetooth/hci1/rfkill1321'
---[ end trace 984285625d9f4992 ]---
kobject: 'hci5' (0000000076c884f7): fill_kobj_path: path  
= '/devices/virtual/bluetooth/hci5'
kobject: 'hci2' (0000000016287cb9): kobject_add_internal:  
parent: 'bluetooth', set: 'devices'
kobject: 'hci3' (00000000c8669077): kobject_uevent_env
RIP: 0010:kernfs_add_one+0x342/0x4d0 fs/kernfs/dir.c:812
kobject: 'hci3' (00000000c8669077): fill_kobj_path: path  
= '/devices/virtual/bluetooth/hci3'
kobject: 'hci2' (0000000016287cb9): kobject_uevent_env
kobject: 'rfkill1320' (000000000f2f7b02): kobject_cleanup, parent            
(null)
kobject: 'hci2' (0000000016287cb9): fill_kobj_path: path  
= '/devices/virtual/bluetooth/hci2'
kobject: 'rfkill1321' (00000000bd6cc24c): kobject_uevent_env
Code: 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 49 01 00 00 48 b8 00 00 00 00  
00 fc ff df 4d 8b 6d 70 49 8d 7d 08 48 89 fa 48 c1 ea 03 <0f> b6 04 02 84  
c0 74 08 3c 03 0f 8e 16 01 00 00 45 8b 6d 08 31 ff
kobject: 'rfkill1322' (00000000876a5655): kobject_add_internal:  
parent: 'hci5', set: 'devices'
RSP: 0018:ffff8801bc5df588 EFLAGS: 00010202
kobject: 'rfkill1321' (00000000bd6cc24c): fill_kobj_path: path  
= '/devices/virtual/bluetooth/hci1/rfkill1321'
kobject: 'rfkill1320' (000000000f2f7b02): calling ktype release
RAX: dffffc0000000000 RBX: ffff8801ba043380 RCX: ffffffff87bea6d7
kobject: 'rfkill1322' (00000000876a5655): kobject_uevent_env
RDX: 0000000000000001 RSI: ffffffff81f7f9ca RDI: 0000000000000008
kobject: 'rfkill1320': free name
kobject: 'rfkill1322' (00000000876a5655): fill_kobj_path: path  
= '/devices/virtual/bluetooth/hci5/rfkill1322'
kobject: 'hci4' (0000000004abaebf): kobject_uevent_env
RBP: ffff8801bc5df5d0 R08: fffffbfff12d121d R09: fffffbfff12d121c
kobject: 'hci4' (0000000004abaebf): fill_kobj_path: path  
= '/devices/virtual/bluetooth/hci4'
R10: fffffbfff12d121c R11: ffffffff896890e7 R12: 0000000000000000
kobject: 'hci4' (0000000004abaebf): kobject_cleanup, parent           (null)
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
kobject: 'rfkill1322' (00000000876a5655): kobject_uevent_env
FS:  0000000001901880(0000) GS:ffff8801daf00000(0000) knlGS:0000000000000000
kobject: 'rfkill1322' (00000000876a5655): fill_kobj_path: path  
= '/devices/virtual/bluetooth/hci5/rfkill1322'
kobject: 'rfkill1323' (000000001d9583a0): kobject_add_internal:  
parent: 'hci2', set: 'devices'
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
kobject: 'rfkill1323' (000000001d9583a0): kobject_uevent_env
CR2: 00007f5e5ce5a000 CR3: 00000001bb73b000 CR4: 00000000001406e0
kobject: 'hci4' (0000000004abaebf): calling ktype release
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
kobject: 'rfkill1323' (000000001d9583a0): fill_kobj_path: path  
= '/devices/virtual/bluetooth/hci2/rfkill1323'
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
kobject: 'hci4': free name


---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.

syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#bug-status-tracking for how to communicate with  
syzbot.
syzbot can test patches for this bug, for details see:
https://goo.gl/tpsmEJ#testing-patches

Re: general protection fault in kernfs_add_one

[syzbot]

syzbot has bisected this bug to:

commit 726e41097920a73e4c7c33385dcc0debb1281e18
Author: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Date:   Tue Jul 10 00:29:10 2018 +0000

     drivers: core: Remove glue dirs from sysfs earlier

bisection log:  https://syzkaller.appspot.com/x/bisect.txt?x=168e1012e00000
start commit:   5e335542 Merge branch 'for-linus' of git://git.kernel.org/..
git tree:       upstream
final crash:    https://syzkaller.appspot.com/x/report.txt?x=158e1012e00000
console output: https://syzkaller.appspot.com/x/log.txt?x=118e1012e00000
kernel config:  https://syzkaller.appspot.com/x/.config?x=9917ff4b798e1a1e
dashboard link: https://syzkaller.appspot.com/bug?extid=db1637662f412ac0d556
syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=10a66c11400000
C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=1346c771400000

Reported-by: syzbot+db1637662f412ac0d556@syzkaller.appspotmail.com
Fixes: 726e41097920 ("drivers: core: Remove glue dirs from sysfs earlier")

For information about bisection process see: https://goo.gl/tpsmEJ#bisection

Re: general protection fault in kernfs_add_one

[Linus Torvalds]

So looking at the decode, as usual the noise generated by KASAN isn't
being very helpful, but it does look like at least one of the reports
(I picked 5.2 because I don't care about 4.19 etc) is because
'kernfs_root(kn) is NULL in kernfs_add_one().

Looking at the reports, every single one seems to have a call chain
that comes from vhci_write() -> vhci_get_user() ->
vhci_create_device() -> __vhci_create_device() -> hci_register_dev()
-> device_add() -> kobject_add().

(In this case, "every single one" is by looking at the last 10 reports
sorted by date, it wasn't exhaustive).

The way it got into 'write()' can be a bit varied (splice, write, whatever).

That makes me think it's bluetooth that is the problem, but it might
be an effect of how syzbot groups the reports too, of course.

Might the device have been added at the same time that the last
previous device was removed, so that the parent was deleted as the new
device was aded? I dunno. The repro seem to be a repeated "open
/dev/vhci, write two random bytes to it"

Or might it be some "it happens after you've added enough devices that
something overflows" issue?

Adding bluetooth people to the cc.

                  Linus

On Mon, Nov 18, 2019 at 10:27 PM syzbot
<syzbot+db1637662f412ac0d556@syzkaller.appspotmail.com> wrote:
>
> syzbot has bisected this bug to:
>
> commit 726e41097920a73e4c7c33385dcc0debb1281e18
> Author: Benjamin Herrenschmidt <benh@kernel.crashing.org>
> Date:   Tue Jul 10 00:29:10 2018 +0000
>
>      drivers: core: Remove glue dirs from sysfs earlier
>
> bisection log:  https://syzkaller.appspot.com/x/bisect.txt?x=168e1012e00000
> start commit:   5e335542 Merge branch 'for-linus' of git://git.kernel.org/..
> git tree:       upstream
> final crash:    https://syzkaller.appspot.com/x/report.txt?x=158e1012e00000
> console output: https://syzkaller.appspot.com/x/log.txt?x=118e1012e00000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=9917ff4b798e1a1e
> dashboard link: https://syzkaller.appspot.com/bug?extid=db1637662f412ac0d556
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=10a66c11400000
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=1346c771400000
>
> Reported-by: syzbot+db1637662f412ac0d556@syzkaller.appspotmail.com
> Fixes: 726e41097920 ("drivers: core: Remove glue dirs from sysfs earlier")
>
> For information about bisection process see: https://goo.gl/tpsmEJ#bisection

Re: general protection fault in kernfs_add_one

[Marcel Holtmann]

Hi Linus,

> So looking at the decode, as usual the noise generated by KASAN isn't
> being very helpful, but it does look like at least one of the reports
> (I picked 5.2 because I don't care about 4.19 etc) is because
> 'kernfs_root(kn) is NULL in kernfs_add_one().
> 
> Looking at the reports, every single one seems to have a call chain
> that comes from vhci_write() -> vhci_get_user() ->
> vhci_create_device() -> __vhci_create_device() -> hci_register_dev()
> -> device_add() -> kobject_add().
> 
> (In this case, "every single one" is by looking at the last 10 reports
> sorted by date, it wasn't exhaustive).
> 
> The way it got into 'write()' can be a bit varied (splice, write, whatever).
> 
> That makes me think it's bluetooth that is the problem, but it might
> be an effect of how syzbot groups the reports too, of course.
> 
> Might the device have been added at the same time that the last
> previous device was removed, so that the parent was deleted as the new
> device was aded? I dunno. The repro seem to be a repeated "open
> /dev/vhci, write two random bytes to it"
> 
> Or might it be some "it happens after you've added enough devices that
> something overflows" issue?

long time ago there used to be an issue with quick device remove / device add operations, but that was fixed. I am just too fuzzy on the details since it has been a while.

We also haven’t touched our sysfs integration in a while and Bluetooth support is so old that this might have been bit-rotting.

I need to run the re-producer myself and see if something stands out that I can spot.

Regards

Marcel

Re: general protection fault in kernfs_add_one

[Benjamin Herrenschmidt]

On Tue, 2019-11-19 at 11:00 -0800, Linus Torvalds wrote:
> So looking at the decode, as usual the noise generated by KASAN isn't
> being very helpful, but it does look like at least one of the reports
> (I picked 5.2 because I don't care about 4.19 etc) is because
> 'kernfs_root(kn) is NULL in kernfs_add_one().
> 
> Looking at the reports, every single one seems to have a call chain
> that comes from vhci_write() -> vhci_get_user() ->
> vhci_create_device() -> __vhci_create_device() -> hci_register_dev()
> -> device_add() -> kobject_add().
> 
> (In this case, "every single one" is by looking at the last 10
> reports
> sorted by date, it wasn't exhaustive).
> 
> The way it got into 'write()' can be a bit varied (splice, write,
> whatever).
> 
> That makes me think it's bluetooth that is the problem, but it might
> be an effect of how syzbot groups the reports too, of course.
> 
> Might the device have been added at the same time that the last
> previous device was removed, so that the parent was deleted as the
> new
> device was aded? I dunno. The repro seem to be a repeated "open
> /dev/vhci, write two random bytes to it"
> 
> Or might it be some "it happens after you've added enough devices
> that
> something overflows" issue?
> 
> Adding bluetooth people to the cc.

Could this be what was fixed by:

ac43432cb1f5c2950408534987e57c2071e24d8f
("driver core: Fix use-after-free and double free on glue directory")

Which went into 5.3 afaik ?

Cheers,
Ben.

>                   Linus
> 
> On Mon, Nov 18, 2019 at 10:27 PM syzbot
> <syzbot+db1637662f412ac0d556@syzkaller.appspotmail.com> wrote:
> > 
> > syzbot has bisected this bug to:
> > 
> > commit 726e41097920a73e4c7c33385dcc0debb1281e18
> > Author: Benjamin Herrenschmidt <benh@kernel.crashing.org>
> > Date:   Tue Jul 10 00:29:10 2018 +0000
> > 
> >      drivers: core: Remove glue dirs from sysfs earlier
> > 
> > bisection log:  
> > https://syzkaller.appspot.com/x/bisect.txt?x=168e1012e00000
> > start commit:   5e335542 Merge branch 'for-linus' of
> > git://git.kernel.org/..
> > git tree:       upstream
> > final crash:    
> > https://syzkaller.appspot.com/x/report.txt?x=158e1012e00000
> > console output: 
> > https://syzkaller.appspot.com/x/log.txt?x=118e1012e00000
> > kernel config:  
> > https://syzkaller.appspot.com/x/.config?x=9917ff4b798e1a1e
> > dashboard link: 
> > https://syzkaller.appspot.com/bug?extid=db1637662f412ac0d556
> > syz repro:      
> > https://syzkaller.appspot.com/x/repro.syz?x=10a66c11400000
> > C reproducer:   
> > https://syzkaller.appspot.com/x/repro.c?x=1346c771400000
> > 
> > Reported-by: syzbot+db1637662f412ac0d556@syzkaller.appspotmail.com
> > Fixes: 726e41097920 ("drivers: core: Remove glue dirs from sysfs
> > earlier")
> > 
> > For information about bisection process see: 
> > https://goo.gl/tpsmEJ#bisection

Re: general protection fault in kernfs_add_one

[Linus Torvalds]

On Tue, Nov 19, 2019 at 8:04 PM Benjamin Herrenschmidt
<benh@kernel.crashing.org> wrote:
>
> Could this be what was fixed by:
>
> ac43432cb1f5c2950408534987e57c2071e24d8f
> ("driver core: Fix use-after-free and double free on glue directory")
>
> Which went into 5.3 afaik ?

Hmm. Sounds very possible. It matches the commit syzbot bisected to,
and looking at the reports, the I can't find anything that is 5.3 or
later.

I did find a 5.3.0-rc2+ report, but that's still consistent with that
commit: it got merged just before 5.3-rc4.

So I think you're right.

I forget what the magic email rule was to report that something is
fixed to syzbot..

              Linus

Re: general protection fault in kernfs_add_one

[Dmitry Vyukov]

On Wed, Nov 20, 2019 at 5:54 PM Linus Torvalds
<torvalds@linux-foundation.org> wrote:
>
> On Tue, Nov 19, 2019 at 8:04 PM Benjamin Herrenschmidt
> <benh@kernel.crashing.org> wrote:
> >
> > Could this be what was fixed by:
> >
> > ac43432cb1f5c2950408534987e57c2071e24d8f
> > ("driver core: Fix use-after-free and double free on glue directory")
> >
> > Which went into 5.3 afaik ?
>
> Hmm. Sounds very possible. It matches the commit syzbot bisected to,
> and looking at the reports, the I can't find anything that is 5.3 or
> later.
>
> I did find a 5.3.0-rc2+ report, but that's still consistent with that
> commit: it got merged just before 5.3-rc4.
>
> So I think you're right.
>
> I forget what the magic email rule was to report that something is
> fixed to syzbot..

Hi Linus,

This would be:

#syz fix: driver core: Fix use-after-free and double free on glue directory

FTR, the cheat sheet is referenced in every bug report:

> syzbot will keep track of this bug report. See:
> https://goo.gl/tpsmEJ#bug-status-tracking for how to communicate with syzbot.