[syzbot] general protection fault in __pm_runtime_resume (2)

8 views
Skip to first unread message

syzbot

unread,
Mar 13, 2022, 12:35:26 AM3/13/22
to gre...@linuxfoundation.org, len....@intel.com, linux-...@vger.kernel.org, linu...@vger.kernel.org, pa...@ucw.cz, raf...@kernel.org, syzkall...@googlegroups.com
Hello,

syzbot found the following issue on:

HEAD commit: 92f90cc9fe0e Merge tag 'fuse-fixes-5.17-rc8' of git://git...
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=118cd3be700000
kernel config: https://syzkaller.appspot.com/x/.config?x=442f8ac61e60a75e
dashboard link: https://syzkaller.appspot.com/bug?extid=b9bd12fbed3485a3e51f
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=15b64e79700000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1652811a700000

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+b9bd12...@syzkaller.appspotmail.com

general protection fault, probably for non-canonical address 0xdffffc0000000072: 0000 [#1] PREEMPT SMP KASAN
KASAN: null-ptr-deref in range [0x0000000000000390-0x0000000000000397]
CPU: 0 PID: 46 Comm: kworker/u5:0 Not tainted 5.17.0-rc7-syzkaller-00060-g92f90cc9fe0e #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: hci0 hci_cmd_work
RIP: 0010:__pm_runtime_resume+0x45/0x170 drivers/base/power/runtime.c:1126
Code: 44 89 ee e8 2d af 02 fd 45 85 ed 75 4e e8 a3 ab 02 fd 48 8d bd 91 03 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <0f> b6 04 02 48 89 fa 83 e2 07 38 d0 7f 08 84 c0 0f 85 03 01 00 00
RSP: 0018:ffffc9000116fc28 EFLAGS: 00010216
RAX: dffffc0000000000 RBX: ffff888022f8d000 RCX: 0000000000000000
RDX: 0000000000000072 RSI: ffffffff8476148d RDI: 0000000000000391
RBP: 0000000000000000 R08: 0000000000000000 R09: ffffffff8ffc4a0f
R10: ffffffff84761483 R11: 000000000000000a R12: 0000000000000004
R13: 0000000000000000 R14: ffff888022f8d190 R15: ffff888022f8d128
FS: 0000000000000000(0000) GS:ffff8880b9c00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffc3fad2418 CR3: 000000007f4c3000 CR4: 0000000000350ef0
Call Trace:
<TASK>
pm_runtime_get_sync include/linux/pm_runtime.h:420 [inline]
h5_enqueue+0x175/0x390 drivers/bluetooth/hci_h5.c:632
hci_uart_send_frame+0x1ee/0x6b0 drivers/bluetooth/hci_ldisc.c:286
hci_send_frame+0x1c0/0x370 net/bluetooth/hci_core.c:2942
hci_cmd_work+0x204/0x3c0 net/bluetooth/hci_core.c:3861
process_one_work+0x9ac/0x1650 kernel/workqueue.c:2307
worker_thread+0x657/0x1110 kernel/workqueue.c:2454
kthread+0x2e9/0x3a0 kernel/kthread.c:377
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:__pm_runtime_resume+0x45/0x170 drivers/base/power/runtime.c:1126
Code: 44 89 ee e8 2d af 02 fd 45 85 ed 75 4e e8 a3 ab 02 fd 48 8d bd 91 03 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <0f> b6 04 02 48 89 fa 83 e2 07 38 d0 7f 08 84 c0 0f 85 03 01 00 00
RSP: 0018:ffffc9000116fc28 EFLAGS: 00010216
RAX: dffffc0000000000 RBX: ffff888022f8d000 RCX: 0000000000000000
RDX: 0000000000000072 RSI: ffffffff8476148d RDI: 0000000000000391
RBP: 0000000000000000 R08: 0000000000000000 R09: ffffffff8ffc4a0f
R10: ffffffff84761483 R11: 000000000000000a R12: 0000000000000004
R13: 0000000000000000 R14: ffff888022f8d190 R15: ffff888022f8d128
FS: 0000000000000000(0000) GS:ffff8880b9c00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f989adfd718 CR3: 000000007683c000 CR4: 0000000000350ef0
----------------
Code disassembly (best guess):
0: 44 89 ee mov %r13d,%esi
3: e8 2d af 02 fd callq 0xfd02af35
8: 45 85 ed test %r13d,%r13d
b: 75 4e jne 0x5b
d: e8 a3 ab 02 fd callq 0xfd02abb5
12: 48 8d bd 91 03 00 00 lea 0x391(%rbp),%rdi
19: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax
20: fc ff df
23: 48 89 fa mov %rdi,%rdx
26: 48 c1 ea 03 shr $0x3,%rdx
* 2a: 0f b6 04 02 movzbl (%rdx,%rax,1),%eax <-- trapping instruction
2e: 48 89 fa mov %rdi,%rdx
31: 83 e2 07 and $0x7,%edx
34: 38 d0 cmp %dl,%al
36: 7f 08 jg 0x40
38: 84 c0 test %al,%al
3a: 0f 85 03 01 00 00 jne 0x143


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot can test patches for this issue, for details see:
https://goo.gl/tpsmEJ#testing-patches

Pavel Skripkin

unread,
Mar 13, 2022, 1:27:59 PM3/13/22
to syzbot, gre...@linuxfoundation.org, len....@intel.com, linux-...@vger.kernel.org, linu...@vger.kernel.org, pa...@ucw.cz, raf...@kernel.org, syzkall...@googlegroups.com
On 3/13/22 08:35, syzbot wrote:
> Hello,
>
> syzbot found the following issue on:
>
> HEAD commit: 92f90cc9fe0e Merge tag 'fuse-fixes-5.17-rc8' of git://git...
> git tree: upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=118cd3be700000
> kernel config: https://syzkaller.appspot.com/x/.config?x=442f8ac61e60a75e
> dashboard link: https://syzkaller.appspot.com/bug?extid=b9bd12fbed3485a3e51f
> compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=15b64e79700000
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1652811a700000
>
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+b9bd12...@syzkaller.appspotmail.com
>

hu->serdev should be checked before passing to pm functions

#syz test:
git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git





With regards,
Pavel Skripkin
ph

syzbot

unread,
Mar 13, 2022, 1:27:59 PM3/13/22
to Pavel Skripkin, gre...@linuxfoundation.org, len....@intel.com, linux-...@vger.kernel.org, linu...@vger.kernel.org, paskr...@gmail.com, pa...@ucw.cz, raf...@kernel.org, syzkall...@googlegroups.com
> On 3/13/22 08:35, syzbot wrote:
>> Hello,
>>
>> syzbot found the following issue on:
>>
>> HEAD commit: 92f90cc9fe0e Merge tag 'fuse-fixes-5.17-rc8' of git://git...
>> git tree: upstream
>> console output: https://syzkaller.appspot.com/x/log.txt?x=118cd3be700000
>> kernel config: https://syzkaller.appspot.com/x/.config?x=442f8ac61e60a75e
>> dashboard link: https://syzkaller.appspot.com/bug?extid=b9bd12fbed3485a3e51f
>> compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
>> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=15b64e79700000
>> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1652811a700000
>>
>> IMPORTANT: if you fix the issue, please add the following tag to the commit:
>> Reported-by: syzbot+b9bd12...@syzkaller.appspotmail.com
>>
>
> hu->serdev should be checked before passing to pm functions
>
> #syz test:

want 2 args (repo, branch), got 3

syzbot

unread,
Mar 13, 2022, 1:28:01 PM3/13/22
to Pavel Skripkin, gre...@linuxfoundation.org, len....@intel.com, linux-...@vger.kernel.org, linu...@vger.kernel.org, paskr...@gmail.com, pa...@ucw.cz, raf...@kernel.org, syzkall...@googlegroups.com
> On 3/13/22 08:35, syzbot wrote:
>> Hello,
>>
>> syzbot found the following issue on:
>>
>> HEAD commit: 92f90cc9fe0e Merge tag 'fuse-fixes-5.17-rc8' of git://git...
>> git tree: upstream
>> console output: https://syzkaller.appspot.com/x/log.txt?x=118cd3be700000
>> kernel config: https://syzkaller.appspot.com/x/.config?x=442f8ac61e60a75e
>> dashboard link: https://syzkaller.appspot.com/bug?extid=b9bd12fbed3485a3e51f
>> compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
>> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=15b64e79700000
>> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1652811a700000
>>
>> IMPORTANT: if you fix the issue, please add the following tag to the commit:
>> Reported-by: syzbot+b9bd12...@syzkaller.appspotmail.com
>>
>
> hu->serdev should be checked before passing to pm functions
>
> #syz test:

want 2 args (repo, branch), got 3

> git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
>
>
>
>
>
> With regards,
> Pavel Skripkin
>
> --
> You received this message because you are subscribed to the Google Groups "syzkaller-bugs" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to syzkaller-bug...@googlegroups.com.
> To view this discussion on the web visit https://groups.google.com/d/msgid/syzkaller-bugs/79d2c7e0-c4ed-fa89-5d97-4b143356f814%40gmail.com.

Pavel Skripkin

unread,
Mar 13, 2022, 1:29:53 PM3/13/22
to syzbot, gre...@linuxfoundation.org, len....@intel.com, linux-...@vger.kernel.org, linu...@vger.kernel.org, pa...@ucw.cz, raf...@kernel.org, syzkall...@googlegroups.com
On 3/13/22 20:27, syzbot wrote:
>> On 3/13/22 08:35, syzbot wrote:
>>> Hello,
>>>
>>> syzbot found the following issue on:
>>>
>>> HEAD commit: 92f90cc9fe0e Merge tag 'fuse-fixes-5.17-rc8' of git://git...
>>> git tree: upstream
>>> console output: https://syzkaller.appspot.com/x/log.txt?x=118cd3be700000
>>> kernel config: https://syzkaller.appspot.com/x/.config?x=442f8ac61e60a75e
>>> dashboard link: https://syzkaller.appspot.com/bug?extid=b9bd12fbed3485a3e51f
>>> compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
>>> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=15b64e79700000
>>> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1652811a700000
>>>
>>> IMPORTANT: if you fix the issue, please add the following tag to the commit:
>>> Reported-by: syzbot+b9bd12...@syzkaller.appspotmail.com
>>>
>>
>> hu->serdev should be checked before passing to pm functions
>>
>> #syz test:
>
> want 2 args (repo, branch), got 3
>

Woops

#syz test:
git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master



With regards,
Pavel Skripkin
ph

syzbot

unread,
Mar 13, 2022, 1:41:10 PM3/13/22
to gre...@linuxfoundation.org, len....@intel.com, linux-...@vger.kernel.org, linu...@vger.kernel.org, paskr...@gmail.com, pa...@ucw.cz, raf...@kernel.org, syzkall...@googlegroups.com
Hello,

syzbot has tested the proposed patch and the reproducer did not trigger any issue:

Reported-and-tested-by: syzbot+b9bd12...@syzkaller.appspotmail.com

Tested on:

commit: aad611a8 Merge tag 'perf-tools-fixes-for-v5.17-2022-03..
git tree: upstream
kernel config: https://syzkaller.appspot.com/x/.config?x=442f8ac61e60a75e
dashboard link: https://syzkaller.appspot.com/bug?extid=b9bd12fbed3485a3e51f
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
patch: https://syzkaller.appspot.com/x/patch.diff?x=105cb5a5700000

Note: testing is done by a robot and is best-effort only.

Hillf Danton

unread,
Mar 13, 2022, 8:37:39 PM3/13/22
to syzbot, linux-...@vger.kernel.org, syzkall...@googlegroups.com
On Sat, 12 Mar 2022 21:35:25 -0800
What triggered the report is device is unregistered without workqueue
work flushed - fix it by serializing the close and work pathes using
the hu->proto_lock.

Hillf

#syz test: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/ 92f90cc9fe0e

--- x/drivers/bluetooth/hci_serdev.c
+++ y/drivers/bluetooth/hci_serdev.c
@@ -395,7 +395,10 @@ void hci_uart_unregister_device(struct h
hu->proto->close(hu);

if (test_bit(HCI_UART_PROTO_READY, &hu->flags)) {
+ percpu_down_write(&hu->proto_lock);
clear_bit(HCI_UART_PROTO_READY, &hu->flags);
+ percpu_up_write(&hu->proto_lock);
+
serdev_device_close(hu->serdev);
}
}
--

syzbot

unread,
Mar 13, 2022, 8:49:09 PM3/13/22
to hda...@sina.com, linux-...@vger.kernel.org, syzkall...@googlegroups.com
Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
general protection fault in __pm_runtime_resume

general protection fault, probably for non-canonical address 0xdffffc0000000072: 0000 [#1] PREEMPT SMP KASAN
KASAN: null-ptr-deref in range [0x0000000000000390-0x0000000000000397]
CPU: 0 PID: 45 Comm: kworker/u5:0 Not tainted 5.17.0-rc7-syzkaller-00060-g92f90cc9fe0e-dirty #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: hci0 hci_cmd_work
RIP: 0010:__pm_runtime_resume+0x45/0x170 drivers/base/power/runtime.c:1126
Code: 44 89 ee e8 2d af 02 fd 45 85 ed 75 4e e8 a3 ab 02 fd 48 8d bd 91 03 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <0f> b6 04 02 48 89 fa 83 e2 07 38 d0 7f 08 84 c0 0f 85 03 01 00 00
RSP: 0018:ffffc9000115fc28 EFLAGS: 00010216
RAX: dffffc0000000000 RBX: ffff888021a7e000 RCX: 0000000000000000
RDX: 0000000000000072 RSI: ffffffff8476148d RDI: 0000000000000391
RBP: 0000000000000000 R08: 0000000000000000 R09: ffffffff8ffc4a7f
R10: ffffffff84761483 R11: 000000000000000c R12: 0000000000000004
R13: 0000000000000000 R14: ffff888021a7e190 R15: ffff888021a7e128
FS: 0000000000000000(0000) GS:ffff8880b9c00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000555c48214048 CR3: 000000007e914000 CR4: 0000000000350ef0
Call Trace:
<TASK>
pm_runtime_get_sync include/linux/pm_runtime.h:420 [inline]
h5_enqueue+0x175/0x390 drivers/bluetooth/hci_h5.c:632
hci_uart_send_frame+0x1ee/0x6b0 drivers/bluetooth/hci_ldisc.c:286
hci_send_frame+0x1c0/0x370 net/bluetooth/hci_core.c:2942
hci_cmd_work+0x204/0x3c0 net/bluetooth/hci_core.c:3861
process_one_work+0x9ac/0x1650 kernel/workqueue.c:2307
worker_thread+0x657/0x1110 kernel/workqueue.c:2454
kthread+0x2e9/0x3a0 kernel/kthread.c:377
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:__pm_runtime_resume+0x45/0x170 drivers/base/power/runtime.c:1126
Code: 44 89 ee e8 2d af 02 fd 45 85 ed 75 4e e8 a3 ab 02 fd 48 8d bd 91 03 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <0f> b6 04 02 48 89 fa 83 e2 07 38 d0 7f 08 84 c0 0f 85 03 01 00 00
RSP: 0018:ffffc9000115fc28 EFLAGS: 00010216
RAX: dffffc0000000000 RBX: ffff888021a7e000 RCX: 0000000000000000
RDX: 0000000000000072 RSI: ffffffff8476148d RDI: 0000000000000391
RBP: 0000000000000000 R08: 0000000000000000 R09: ffffffff8ffc4a7f
R10: ffffffff84761483 R11: 000000000000000c R12: 0000000000000004
R13: 0000000000000000 R14: ffff888021a7e190 R15: ffff888021a7e128
FS: 0000000000000000(0000) GS:ffff8880b9c00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fcda3cf0718 CR3: 0000000021ecd000 CR4: 0000000000350ef0
----------------
Code disassembly (best guess):
0: 44 89 ee mov %r13d,%esi
3: e8 2d af 02 fd callq 0xfd02af35
8: 45 85 ed test %r13d,%r13d
b: 75 4e jne 0x5b
d: e8 a3 ab 02 fd callq 0xfd02abb5
12: 48 8d bd 91 03 00 00 lea 0x391(%rbp),%rdi
19: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax
20: fc ff df
23: 48 89 fa mov %rdi,%rdx
26: 48 c1 ea 03 shr $0x3,%rdx
* 2a: 0f b6 04 02 movzbl (%rdx,%rax,1),%eax <-- trapping instruction
2e: 48 89 fa mov %rdi,%rdx
31: 83 e2 07 and $0x7,%edx
34: 38 d0 cmp %dl,%al
36: 7f 08 jg 0x40
38: 84 c0 test %al,%al
3a: 0f 85 03 01 00 00 jne 0x143


Tested on:

commit: 92f90cc9 Merge tag 'fuse-fixes-5.17-rc8' of git://git...
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/
console output: https://syzkaller.appspot.com/x/log.txt?x=15ec83ad700000
kernel config: https://syzkaller.appspot.com/x/.config?x=442f8ac61e60a75e
dashboard link: https://syzkaller.appspot.com/bug?extid=b9bd12fbed3485a3e51f
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
patch: https://syzkaller.appspot.com/x/patch.diff?x=16d10379700000

Reply all
Reply to author
Forward
0 new messages