[Linux Kernel Bug] general protection fault in dvb_device_open

[Jiaming Zhang]

Dear Linux kernel developers and maintainers,

We are writing to report a general protection fault discovered in the
dvb subsystem. Unfortunately, we do not currently have a reproducer
for this issue.

Based on our analysis, we suspect this is caused by a race condition.
It appears that dvbdev is freed, but the corresponding entry in
dvb_minors is not cleared or updated in time. Consequently, the kernel
attempts to access this freed memory, resulting in a system crash.
(https://elixir.bootlin.com/linux/v6.19-rc4/source/drivers/media/dvb-core/dvbdev.c#L97-L103)

We have attached the kernel console output and the kernel config to
assist with the analysis. The issue report, symbolized by
syz-symbolize, is listed below:

---

Oops: general protection fault, probably for non-canonical address
0xfbd5a5d5a0000000: 0000 [#1] SMP KASAN NOPTI
KASAN: maybe wild-memory-access in range [0xdead4ead00000000-0xdead4ead00000007]
CPU: 1 UID: 0 PID: 52451 Comm: syz.8.4023 Tainted: G L
6.19.0-rc4-00020-gf0b9d8eb98df #1 PREEMPT(full)
Tainted: [L]=SOFTLOCKUP
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
RIP: 0010:dvb_device_open+0xd8/0x350 drivers/media/dvb-core/dvbdev.c:103
Code: 18 4c 89 e0 48 c1 e8 03 80 3c 18 00 74 08 4c 89 e7 e8 bc 39 7e
fa 4d 8b 2c 24 4d 85 ed 0f 84 45 01 00 00 4c 89 e8 48 c1 e8 03 <80> 3c
18 00 74 08 4c 89 ef e8 9a 39 7e fa 49 8b 7d 00 e8 01 3a 02
RSP: 0018:ffffc90002ed7790 EFLAGS: 00010216
RAX: 1bd5a9d5a0000000 RBX: dffffc0000000000 RCX: 0000000000000000
RDX: 0000000000000001 RSI: 0000000000000008 RDI: 00000000ffffffff
RBP: ffff888000d31340 R08: ffffffff8ee11d8f R09: 1ffffffff1dc23b1
R10: dffffc0000000000 R11: fffffbfff1dc23b2 R12: ffff888022eff818
R13: dead4ead00000000 R14: ffff8880205bef78 R15: ffff888022eff800
FS: 00007f895f3b9640(0000) GS:ffff8880ec62c000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f895e7f29f0 CR3: 000000005d0a1000 CR4: 0000000000750ef0
PKRU: 80000000
Call Trace:
<TASK>
chrdev_open+0x4cc/0x5e0 fs/char_dev.c:414
do_dentry_open+0x7b1/0x1410 fs/open.c:962
vfs_open+0x3b/0x340 fs/open.c:1094
do_open fs/namei.c:4628 [inline]
path_openat+0x3413/0x3dd0 fs/namei.c:4787
do_filp_open+0x1fa/0x410 fs/namei.c:4814
do_sys_openat2+0x121/0x230 fs/open.c:1430
do_sys_open fs/open.c:1436 [inline]
__do_sys_openat fs/open.c:1452 [inline]
__se_sys_openat fs/open.c:1447 [inline]
__x64_sys_openat+0x138/0x170 fs/open.c:1447
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xe8/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f895e5b2d94
Code: 24 20 eb 8f 66 90 44 89 54 24 0c e8 e6 0f 03 00 44 8b 54 24 0c
44 89 e2 48 89 ee 41 89 c0 bf 9c ff ff ff b8 01 01 00 00 0f 05 <48> 3d
00 f0 ff ff 77 34 44 89 c7 89 44 24 0c e8 28 10 03 00 8b 44
RSP: 002b:00007f895f3b8ac0 EFLAGS: 00000293 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f895e5b2d94
RDX: 00000000001a1200 RSI: 00007f895f3b8b60 RDI: 00000000ffffff9c
RBP: 00007f895f3b8b60 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000293 R12: 00000000001a1200
R13: 00007f895e846038 R14: 00007f895e845fa0 R15: 00007f895f399000
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:dvb_device_open+0xd8/0x350 drivers/media/dvb-core/dvbdev.c:103
Code: 18 4c 89 e0 48 c1 e8 03 80 3c 18 00 74 08 4c 89 e7 e8 bc 39 7e
fa 4d 8b 2c 24 4d 85 ed 0f 84 45 01 00 00 4c 89 e8 48 c1 e8 03 <80> 3c
18 00 74 08 4c 89 ef e8 9a 39 7e fa 49 8b 7d 00 e8 01 3a 02
RSP: 0018:ffffc90002ed7790 EFLAGS: 00010216
RAX: 1bd5a9d5a0000000 RBX: dffffc0000000000 RCX: 0000000000000000
RDX: 0000000000000001 RSI: 0000000000000008 RDI: 00000000ffffffff
RBP: ffff888000d31340 R08: ffffffff8ee11d8f R09: 1ffffffff1dc23b1
R10: dffffc0000000000 R11: fffffbfff1dc23b2 R12: ffff888022eff818
R13: dead4ead00000000 R14: ffff8880205bef78 R15: ffff888022eff800
FS: 00007f895f3b9640(0000) GS:ffff88809902c000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f895e7e15b0 CR3: 000000005d0a1000 CR4: 0000000000750ef0
PKRU: 80000000
----------------
Code disassembly (best guess):
0: 18 4c 89 e0 sbb %cl,-0x20(%rcx,%rcx,4)
4: 48 c1 e8 03 shr $0x3,%rax
8: 80 3c 18 00 cmpb $0x0,(%rax,%rbx,1)
c: 74 08 je 0x16
e: 4c 89 e7 mov %r12,%rdi
11: e8 bc 39 7e fa call 0xfa7e39d2
16: 4d 8b 2c 24 mov (%r12),%r13
1a: 4d 85 ed test %r13,%r13
1d: 0f 84 45 01 00 00 je 0x168
23: 4c 89 e8 mov %r13,%rax
26: 48 c1 e8 03 shr $0x3,%rax
* 2a: 80 3c 18 00 cmpb $0x0,(%rax,%rbx,1) <-- trapping
instruction
2e: 74 08 je 0x38
30: 4c 89 ef mov %r13,%rdi
33: e8 9a 39 7e fa call 0xfa7e39d2
38: 49 8b 7d 00 mov 0x0(%r13),%rdi
3c: e8 .byte 0xe8
3d: 01 3a add %edi,(%rdx)
3f: 02 .byte 0x2

---

Please let me know if any further information is required.

Best Regards,
Jiaming Zhang