From: "Yang, Chenyuan" <cy54@illinois.edu>
To: Hans Verkuil <hverkuil-cisco@xs4all.nl>,
"linux-media@vger.kernel.org" <linux-media@vger.kernel.org>,
"linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>
Cc: "jani.nikula@intel.com" <jani.nikula@intel.com>,
"syzkaller@googlegroups.com" <syzkaller@googlegroups.com>,
"mchehab@kernel.org" <mchehab@kernel.org>,
"Zhao, Zijie" <zijie4@illinois.edu>,
"Zhang, Lingming" <lingming@illinois.edu>
Subject: Re: [Linux Kernel Bugs] KASAN: slab-use-after-free Read in cec_queue_msg_fh and 4 other crashes in the cec device (`cec_ioctl`)
Date: Tue, 13 Feb 2024 16:05:11 +0000 [thread overview]
Message-ID: <0C7B75A2-B4C8-43CB-A57A-910B3674E787@illinois.edu> (raw)
In-Reply-To: <F8D4A291-8CFB-4A25-B296-3CA07B56F459@illinois.edu>
[-- Attachment #1: Type: text/plain, Size: 14642 bytes --]
Hi Hans,
Here is the output for the first warning and its C reproducer is attached:
```
[ 69.031655][ T7985] sshd (7985) used greatest stack depth: 21808 bytes left
[ 135.592879][ T8039] cec-vivid-000-vid-out0: wfc1: 0000000000000000 0110 1000
[ 135.592987][ T8040] cec-vivid-001-vid-out0: wfc1: 0000000000000000 0110 1000
```
Best,
Chenyuan
On 2/13/24, 9:40 AM, "syzkaller@googlegroups.com <mailto:syzkaller@googlegroups.com> on behalf of Yang, Chenyuan" <syzkaller@googlegroups.com <mailto:syzkaller@googlegroups.com> on behalf of cy54@illinois.edu <mailto:cy54@illinois.edu>> wrote:
Hi Hans,
Sorry to reply so late.
Here is the reproducible C program that could trigger the following debug warning:
```
if ((wait_for_completion_killable_timeout(&adap->config_completion, msecs_to_jiffies(10000)) <= 0)) {
dprintk(0, "wfc3: %px %d%d%d%d %x\n", adap->kthread_config,
adap->is_configuring, adap->is_configured,
adap->is_enabled, adap->must_reconfigure, adap->phys_addr);
WARN_ON(1);
}
```
Output:
```
[ 2147.996471][ T29] kauditd_printk_skb: 2 callbacks suppressed
[ 2147.996480][ T29] audit: type=1804 audit(1707782435.859:14): pid=1281266 uid=0 auid=4290
[ 2148.025365][ T29] audit: type=1804 audit(1707782435.879:15): pid=1281266 uid=0 auid=4290
[54569.994174][T772636] cec-vivid-002-vid-cap0: wfc3: 0000000000000000 0110 0
[54569.995754][T772636] WARNING: CPU: 0 PID: 772636 at drivers/media/cec/core/cec-adap.c:1620
[54569.996578][T772636] Modules linked in:
[54569.997066][T772636] CPU: 0 PID: 772636 Comm: exe Not tainted 6.8.0-rc1-00169-gecb1b8288d5
[54569.997804][T772636] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-14
[54569.998416][T772636] RIP: 0010:cec_claim_log_addrs+0x29b/0x7c0
[54569.998830][T772636] Code: 7c 08 84 d2 0f 85 50 04 00 00 44 8b 25 ee 33 9f 0b 31 ff 44 89f
[54570.000124][T772636] RSP: 0018:ffffc90002117b30 EFLAGS: 00010293
[54570.000549][T772636] RAX: 0000000000000000 RBX: ffff88801d6a0000 RCX: ffffffff816a1959
[54570.001086][T772636] RDX: ffff888028e4b900 RSI: ffffffff8710b1ca RDI: 0000000000000005
[54570.001621][T772636] RBP: ffff88801d6a0638 R08: 0000000000000005 R09: 0000000000000000
[54570.002152][T772636] R10: 0000000080000000 R11: 0000000000000001 R12: 0000000000000000
[54570.002684][T772636] R13: ffff88801d6a07da R14: 0000000000000000 R15: 0000000000000001
[54570.004825][T772636] FS: 00007fee0aee1700(0000) GS:ffff88802ca00000(0000) knlGS:000000000
[54570.005445][T772636] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[54570.005893][T772636] CR2: 00007ffe793b19f0 CR3: 000000002130a000 CR4: 00000000000006f0
[54570.006430][T772636] Call Trace:
[54570.006660][T772636] <TASK>
[54570.006871][T772636] ? show_regs+0x96/0xa0
[54570.007197][T772636] ? __warn+0xe6/0x390
[54570.007506][T772636] ? cec_claim_log_addrs+0x29b/0x7c0
[54570.007875][T772636] ? report_bug+0x2dd/0x500
[54570.008203][T772636] ? cec_claim_log_addrs+0x29b/0x7c0
[54570.008573][T772636] ? handle_bug+0x99/0x120
[54570.008891][T772636] ? exc_invalid_op+0x36/0x80
[54570.009220][T772636] ? asm_exc_invalid_op+0x1a/0x20
[54570.009584][T772636] ? __wake_up_klogd.part.0+0x99/0xf0
[54570.009962][T772636] ? cec_claim_log_addrs+0x29a/0x7c0
[54570.010344][T772636] ? cec_claim_log_addrs+0x29b/0x7c0
[54570.010718][T772636] ? cec_adap_enable+0x534/0xbd0
[54570.011065][T772636] __cec_s_log_addrs+0xdfc/0x16e0
[54570.011437][T772636] cec_ioctl+0x1e7c/0x2690
[54570.011778][T772636] ? cec_release+0xbb0/0xbb0
[54570.012107][T772636] ? tomoyo_execute_permission+0x4a0/0x4a0
[54570.012520][T772636] ? __sanitizer_cov_trace_switch+0x54/0x90
[54570.012938][T772636] ? do_vfs_ioctl+0x138/0x16c0
[54570.013493][T772636] ? vfs_fileattr_set+0xc40/0xc40
[54570.013954][T772636] ? lock_downgrade+0x6a0/0x6a0
[54570.014422][T772636] ? bpf_lsm_file_ioctl+0x9/0x10
[54570.014791][T772636] ? cec_release+0xbb0/0xbb0
[54570.015117][T772636] __x64_sys_ioctl+0x19d/0x210
[54570.015466][T772636] do_syscall_64+0xd2/0x250
[54570.015785][T772636] entry_SYSCALL_64_after_hwframe+0x63/0x6b
[54570.016191][T772636] RIP: 0033:0x7fee0affaf29
[54570.016502][T772636] Code: 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 488
[54570.017779][T772636] RSP: 002b:00007fee0aee0e98 EFLAGS: 00000202 ORIG_RAX: 000000000000000
[54570.018343][T772636] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fee0affaf29
[54570.018872][T772636] RDX: 0000000020000680 RSI: 00000000c05c6104 RDI: 0000000000000004
[54570.019411][T772636] RBP: 00007fee0aee0ec0 R08: 0000000000000000 R09: 0000000000000000
[54570.019941][T772636] R10: 0000000000000000 R11: 0000000000000202 R12: 00007ffe792f9dce
[54570.020475][T772636] R13: 00007ffe792f9dcf R14: 00007fee0aee0fc0 R15: 0000000000022000
[54570.021013][T772636] </TASK>
[54570.021234][T772636] Kernel panic - not syncing: kernel: panic_on_warn set ...
[54570.021720][T772636] CPU: 0 PID: 772636 Comm: exe Not tainted 6.8.0-rc1-00169-gecb1b8288d5
[54570.022329][T772636] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-14
[54570.022956][T772636] Call Trace:
[54570.023192][T772636] <TASK>
[54570.023412][T772636] dump_stack_lvl+0xd9/0x150
[54570.023741][T772636] panic+0x6b9/0x760
[54570.024022][T772636] ? panic_smp_self_stop+0xa0/0xa0
[54570.024388][T772636] ? check_panic_on_warn+0x1f/0xc0
[54570.024746][T772636] ? cec_claim_log_addrs+0x29b/0x7c0
[54570.025111][T772636] check_panic_on_warn+0xb1/0xc0
[54570.025459][T772636] __warn+0xf2/0x390
[54570.025740][T772636] ? cec_claim_log_addrs+0x29b/0x7c0
[54570.026109][T772636] report_bug+0x2dd/0x500
[54570.026418][T772636] ? cec_claim_log_addrs+0x29b/0x7c0
[54570.026788][T772636] handle_bug+0x99/0x120
[54570.027085][T772636] exc_invalid_op+0x36/0x80
[54570.027408][T772636] asm_exc_invalid_op+0x1a/0x20
[54570.027748][T772636] RIP: 0010:cec_claim_log_addrs+0x29b/0x7c0
[54570.028154][T772636] Code: 7c 08 84 d2 0f 85 50 04 00 00 44 8b 25 ee 33 9f 0b 31 ff 44 89f
[54570.029431][T772636] RSP: 0018:ffffc90002117b30 EFLAGS: 00010293
[54570.029847][T772636] RAX: 0000000000000000 RBX: ffff88801d6a0000 RCX: ffffffff816a1959
[54570.030380][T772636] RDX: ffff888028e4b900 RSI: ffffffff8710b1ca RDI: 0000000000000005
[54570.030907][T772636] RBP: ffff88801d6a0638 R08: 0000000000000005 R09: 0000000000000000
[54570.031443][T772636] R10: 0000000080000000 R11: 0000000000000001 R12: 0000000000000000
[54570.031972][T772636] R13: ffff88801d6a07da R14: 0000000000000000 R15: 0000000000000001
[54570.032507][T772636] ? __wake_up_klogd.part.0+0x99/0xf0
[54570.032896][T772636] ? cec_claim_log_addrs+0x29a/0x7c0
[54570.033271][T772636] ? cec_adap_enable+0x534/0xbd0
[54570.033620][T772636] __cec_s_log_addrs+0xdfc/0x16e0
[54570.033978][T772636] cec_ioctl+0x1e7c/0x2690
[54570.034296][T772636] ? cec_release+0xbb0/0xbb0
[54570.034623][T772636] ? tomoyo_execute_permission+0x4a0/0x4a0
[54570.035030][T772636] ? __sanitizer_cov_trace_switch+0x54/0x90
[54570.035447][T772636] ? do_vfs_ioctl+0x138/0x16c0
[54570.035782][T772636] ? vfs_fileattr_set+0xc40/0xc40
[54570.036138][T772636] ? lock_downgrade+0x6a0/0x6a0
[54570.036487][T772636] ? bpf_lsm_file_ioctl+0x9/0x10
[54570.036835][T772636] ? cec_release+0xbb0/0xbb0
[54570.037159][T772636] __x64_sys_ioctl+0x19d/0x210
[54570.037497][T772636] do_syscall_64+0xd2/0x250
[54570.037817][T772636] entry_SYSCALL_64_after_hwframe+0x63/0x6b
```
I will collect the programs to trigger another 2 warnings and send you soon.
Best,
Chenyuan
On 2/12/24, 8:42 AM, "Hans Verkuil" <hverkuil-cisco@xs4all.nl <mailto:hverkuil-cisco@xs4all.nl> <mailto:hverkuil-cisco@xs4all.nl <mailto:hverkuil-cisco@xs4all.nl>>> wrote:
Hi Chenyuan,
On 30/01/2024 15:35, Hans Verkuil wrote:
> On 29/01/2024 04:03, Yang, Chenyuan wrote:
>> Hi Hans,
>>
>> Thanks a lot for this new patch!
>>
>> After applying this new patch in the latest kernel (hash: ecb1b8288dc7ccbdcb3b9df005fa1c0e0c0388a7) and fuzzing with Syzkaller, it seems that the hang still exists.
>> To help you better debug it, I attached the covered lines for the fuzz testing and the output of `git diff`. Hope this could help you.
>>
>> By the way, the syscall descriptions for CEC have been merged into the Syzkaller mainstream: https://urldefense.com/v3/__https://github.com/google/syzkaller/blob/master/sys/linux/dev_cec.txt__;!!DZ3fjg!8zd76_aCk9k_5Rn-mW78tk9IyhZUYovPw2SF9v6Pd5Tof8hm8qocM_NFBwbt0oRdAIH5uE8Ql8ysaoTJrMsn-dbvM9Xwwoo$ <https://urldefense.com/v3/__https://github.com/google/syzkaller/blob/master/sys/linux/dev_cec.txt__;!!DZ3fjg!8zd76_aCk9k_5Rn-mW78tk9IyhZUYovPw2SF9v6Pd5Tof8hm8qocM_NFBwbt0oRdAIH5uE8Ql8ysaoTJrMsn-dbvM9Xwwoo$> <https://urldefense.com/v3/__https://github.com/google/syzkaller/blob/master/sys/linux/dev_cec.txt__;!!DZ3fjg!8zd76_aCk9k_5Rn-mW78tk9IyhZUYovPw2SF9v6Pd5Tof8hm8qocM_NFBwbt0oRdAIH5uE8Ql8ysaoTJrMsn-dbvM9Xwwoo$ <https://urldefense.com/v3/__https://github.com/google/syzkaller/blob/master/sys/linux/dev_cec.txt__;!!DZ3fjg!8zd76_aCk9k_5Rn-mW78tk9IyhZUYovPw2SF9v6Pd5Tof8hm8qocM_NFBwbt0oRdAIH5uE8Ql8ysaoTJrMsn-dbvM9Xwwoo$>> .
>>
>> Let me know if you need further information.
>>
>> Best,
>> Chenyuan
>
> Here is another patch. This now time outs on all wait_for_completion calls
> and reports a WARN_ON and shows additional info. Hopefully this will give me
> better insight into what is going on.
>
> Unfortunately I was unable to reproduce this issue on my VM, so I have to
> rely on you to run the test.
Did you have time to run the test with this patch? It would be very useful to
see the results.
Regards,
Hans
>
> Regards,
>
> Hans
>
> [PATCH] Test
>
> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl <mailto:hverkuil-cisco@xs4all.nl> <mailto:hverkuil-cisco@xs4all.nl <mailto:hverkuil-cisco@xs4all.nl>>>
> ---
> diff --git a/drivers/media/cec/core/cec-adap.c b/drivers/media/cec/core/cec-adap.c
> index 5741adf09a2e..b1951eb7f5bd 100644
> --- a/drivers/media/cec/core/cec-adap.c
> +++ b/drivers/media/cec/core/cec-adap.c
> @@ -935,9 +935,12 @@ int cec_transmit_msg_fh(struct cec_adapter *adap, struct cec_msg *msg,
> * Release the lock and wait, retake the lock afterwards.
> */
> mutex_unlock(&adap->lock);
> - wait_for_completion_killable(&data->c);
> - if (!data->completed)
> - cancel_delayed_work_sync(&data->work);
> + if (WARN_ON(wait_for_completion_killable_timeout(&data->c, msecs_to_jiffies(adap->xfer_timeout_ms + 1000)) <= 0)) {
> + dprintk(0, "wfc1: %px %d%d%d%d %x\n", adap->kthread_config,
> + adap->is_configuring, adap->is_configured,
> + adap->is_enabled, adap->must_reconfigure, adap->phys_addr);
> + }
> + cancel_delayed_work_sync(&data->work);
> mutex_lock(&adap->lock);
>
> /* Cancel the transmit if it was interrupted */
> @@ -1563,10 +1566,12 @@ static int cec_config_thread_func(void *arg)
> cec_transmit_msg_fh(adap, &msg, NULL, false);
> }
> }
> + mutex_unlock(&adap->lock);
> + call_void_op(adap, configured);
> + mutex_lock(&adap->lock);
> adap->kthread_config = NULL;
> complete(&adap->config_completion);
> mutex_unlock(&adap->lock);
> - call_void_op(adap, configured);
> return 0;
>
> unconfigure:
> @@ -1592,6 +1597,17 @@ static void cec_claim_log_addrs(struct cec_adapter *adap, bool block)
> if (WARN_ON(adap->is_configuring || adap->is_configured))
> return;
>
> + if (adap->kthread_config) {
> + mutex_unlock(&adap->lock);
> +// wait_for_completion(&adap->config_completion);
> + if (WARN_ON(wait_for_completion_killable_timeout(&adap->config_completion, msecs_to_jiffies(10000)) <= 0)) {
> + dprintk(0, "wfc2: %px %d%d%d%d %x\n", adap->kthread_config,
> + adap->is_configuring, adap->is_configured,
> + adap->is_enabled, adap->must_reconfigure, adap->phys_addr);
> + }
> + mutex_lock(&adap->lock);
> + }
> +
> init_completion(&adap->config_completion);
>
> /* Ready to kick off the thread */
> @@ -1599,11 +1615,17 @@ static void cec_claim_log_addrs(struct cec_adapter *adap, bool block)
> adap->kthread_config = kthread_run(cec_config_thread_func, adap,
> "ceccfg-%s", adap->name);
> if (IS_ERR(adap->kthread_config)) {
> - adap->kthread_config = NULL;
> adap->is_configuring = false;
> + adap->kthread_config = NULL;
> } else if (block) {
> mutex_unlock(&adap->lock);
> - wait_for_completion(&adap->config_completion);
> + //wait_for_completion(&adap->config_completion);
> + if (WARN_ON(wait_for_completion_killable_timeout(&adap->config_completion, msecs_to_jiffies(10000)) <= 0)) {
> + dprintk(0, "wfc3: %px %d%d%d%d %x\n", adap->kthread_config,
> + adap->is_configuring, adap->is_configured,
> + adap->is_enabled, adap->must_reconfigure, adap->phys_addr);
> +
> + }
> mutex_lock(&adap->lock);
> }
> }
> diff --git a/drivers/media/cec/core/cec-api.c b/drivers/media/cec/core/cec-api.c
> index 67dc79ef1705..d64bb716f9c6 100644
> --- a/drivers/media/cec/core/cec-api.c
> +++ b/drivers/media/cec/core/cec-api.c
> @@ -664,6 +664,8 @@ static int cec_release(struct inode *inode, struct file *filp)
> list_del_init(&data->xfer_list);
> }
> mutex_unlock(&adap->lock);
> +
> + mutex_lock(&fh->lock);
> while (!list_empty(&fh->msgs)) {
> struct cec_msg_entry *entry =
> list_first_entry(&fh->msgs, struct cec_msg_entry, list);
> @@ -681,6 +683,7 @@ static int cec_release(struct inode *inode, struct file *filp)
> kfree(entry);
> }
> }
> + mutex_unlock(&fh->lock);
> kfree(fh);
>
> cec_put_device(devnode);
>
--
You received this message because you are subscribed to a topic in the Google Groups "syzkaller" group.
To unsubscribe from this topic, visit https://urldefense.com/v3/__https://groups.google.com/d/topic/syzkaller/wAHwQl5L8xk/unsubscribe__;!!DZ3fjg!6Zy8Roz73ycXIsgxej-lC_SC2_I1wXfZiXEsWChUX398JijiXc0iDFWD0EKyKx-ZrtWsc-zeTKq7SfvIzA$ <https://urldefense.com/v3/__https://groups.google.com/d/topic/syzkaller/wAHwQl5L8xk/unsubscribe__;!!DZ3fjg!6Zy8Roz73ycXIsgxej-lC_SC2_I1wXfZiXEsWChUX398JijiXc0iDFWD0EKyKx-ZrtWsc-zeTKq7SfvIzA$> .
To unsubscribe from this group and all its topics, send an email to syzkaller+unsubscribe@googlegroups.com <mailto:syzkaller+unsubscribe@googlegroups.com>.
To view this discussion on the web visit https://urldefense.com/v3/__https://groups.google.com/d/msgid/syzkaller/F8D4A291-8CFB-4A25-B296-3CA07B56F459 <https://urldefense.com/v3/__https://groups.google.com/d/msgid/syzkaller/F8D4A291-8CFB-4A25-B296-3CA07B56F459>*40illinois.edu__;JQ!!DZ3fjg!6Zy8Roz73ycXIsgxej-lC_SC2_I1wXfZiXEsWChUX398JijiXc0iDFWD0EKyKx-ZrtWsc-zeTKpauJqakQ$ .
[-- Attachment #2: cec-warn-1.c --]
[-- Type: application/octet-stream, Size: 8138 bytes --]
// autogenerated by syzkaller (https://github.com/google/syzkaller)
#define _GNU_SOURCE
#include <dirent.h>
#include <endian.h>
#include <errno.h>
#include <fcntl.h>
#include <pthread.h>
#include <signal.h>
#include <stdarg.h>
#include <stdbool.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/prctl.h>
#include <sys/stat.h>
#include <sys/syscall.h>
#include <sys/types.h>
#include <sys/wait.h>
#include <time.h>
#include <unistd.h>
#include <linux/futex.h>
static unsigned long long procid;
static void sleep_ms(uint64_t ms)
{
usleep(ms * 1000);
}
static uint64_t current_time_ms(void)
{
struct timespec ts;
if (clock_gettime(CLOCK_MONOTONIC, &ts))
exit(1);
return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000;
}
static void thread_start(void* (*fn)(void*), void* arg)
{
pthread_t th;
pthread_attr_t attr;
pthread_attr_init(&attr);
pthread_attr_setstacksize(&attr, 128 << 10);
int i = 0;
for (; i < 100; i++) {
if (pthread_create(&th, &attr, fn, arg) == 0) {
pthread_attr_destroy(&attr);
return;
}
if (errno == EAGAIN) {
usleep(50);
continue;
}
break;
}
exit(1);
}
typedef struct {
int state;
} event_t;
static void event_init(event_t* ev)
{
ev->state = 0;
}
static void event_reset(event_t* ev)
{
ev->state = 0;
}
static void event_set(event_t* ev)
{
if (ev->state)
exit(1);
__atomic_store_n(&ev->state, 1, __ATOMIC_RELEASE);
syscall(SYS_futex, &ev->state, FUTEX_WAKE | FUTEX_PRIVATE_FLAG, 1000000);
}
static void event_wait(event_t* ev)
{
while (!__atomic_load_n(&ev->state, __ATOMIC_ACQUIRE))
syscall(SYS_futex, &ev->state, FUTEX_WAIT | FUTEX_PRIVATE_FLAG, 0, 0);
}
static int event_isset(event_t* ev)
{
return __atomic_load_n(&ev->state, __ATOMIC_ACQUIRE);
}
static int event_timedwait(event_t* ev, uint64_t timeout)
{
uint64_t start = current_time_ms();
uint64_t now = start;
for (;;) {
uint64_t remain = timeout - (now - start);
struct timespec ts;
ts.tv_sec = remain / 1000;
ts.tv_nsec = (remain % 1000) * 1000 * 1000;
syscall(SYS_futex, &ev->state, FUTEX_WAIT | FUTEX_PRIVATE_FLAG, 0, &ts);
if (__atomic_load_n(&ev->state, __ATOMIC_ACQUIRE))
return 1;
now = current_time_ms();
if (now - start > timeout)
return 0;
}
}
static bool write_file(const char* file, const char* what, ...)
{
char buf[1024];
va_list args;
va_start(args, what);
vsnprintf(buf, sizeof(buf), what, args);
va_end(args);
buf[sizeof(buf) - 1] = 0;
int len = strlen(buf);
int fd = open(file, O_WRONLY | O_CLOEXEC);
if (fd == -1)
return false;
if (write(fd, buf, len) != len) {
int err = errno;
close(fd);
errno = err;
return false;
}
close(fd);
return true;
}
static long syz_open_dev(volatile long a0, volatile long a1, volatile long a2)
{
if (a0 == 0xc || a0 == 0xb) {
char buf[128];
sprintf(buf, "/dev/%s/%d:%d", a0 == 0xc ? "char" : "block", (uint8_t)a1, (uint8_t)a2);
return open(buf, O_RDWR, 0);
} else {
char buf[1024];
char* hash;
strncpy(buf, (char*)a0, sizeof(buf) - 1);
buf[sizeof(buf) - 1] = 0;
while ((hash = strchr(buf, '#'))) {
*hash = '0' + (char)(a1 % 10);
a1 /= 10;
}
return open(buf, a2, 0);
}
}
static void kill_and_wait(int pid, int* status)
{
kill(-pid, SIGKILL);
kill(pid, SIGKILL);
for (int i = 0; i < 100; i++) {
if (waitpid(-1, status, WNOHANG | __WALL) == pid)
return;
usleep(1000);
}
DIR* dir = opendir("/sys/fs/fuse/connections");
if (dir) {
for (;;) {
struct dirent* ent = readdir(dir);
if (!ent)
break;
if (strcmp(ent->d_name, ".") == 0 || strcmp(ent->d_name, "..") == 0)
continue;
char abort[300];
snprintf(abort, sizeof(abort), "/sys/fs/fuse/connections/%s/abort", ent->d_name);
int fd = open(abort, O_WRONLY);
if (fd == -1) {
continue;
}
if (write(fd, abort, 1) < 0) {
}
close(fd);
}
closedir(dir);
} else {
}
while (waitpid(-1, status, __WALL) != pid) {
}
}
static void setup_test()
{
prctl(PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0);
setpgrp();
write_file("/proc/self/oom_score_adj", "1000");
}
struct thread_t {
int created, call;
event_t ready, done;
};
static struct thread_t threads[16];
static void execute_call(int call);
static int running;
static void* thr(void* arg)
{
struct thread_t* th = (struct thread_t*)arg;
for (;;) {
event_wait(&th->ready);
event_reset(&th->ready);
execute_call(th->call);
__atomic_fetch_sub(&running, 1, __ATOMIC_RELAXED);
event_set(&th->done);
}
return 0;
}
static void execute_one(void)
{
int i, call, thread;
for (call = 0; call < 4; call++) {
for (thread = 0; thread < (int)(sizeof(threads) / sizeof(threads[0])); thread++) {
struct thread_t* th = &threads[thread];
if (!th->created) {
th->created = 1;
event_init(&th->ready);
event_init(&th->done);
event_set(&th->done);
thread_start(thr, th);
}
if (!event_isset(&th->done))
continue;
event_reset(&th->done);
th->call = call;
__atomic_fetch_add(&running, 1, __ATOMIC_RELAXED);
event_set(&th->ready);
event_timedwait(&th->done, 50);
break;
}
}
for (i = 0; i < 100 && __atomic_load_n(&running, __ATOMIC_RELAXED); i++)
sleep_ms(1);
}
static void execute_one(void);
#define WAIT_FLAGS __WALL
static void loop(void)
{
int iter = 0;
for (;; iter++) {
int pid = fork();
if (pid < 0)
exit(1);
if (pid == 0) {
setup_test();
execute_one();
exit(0);
}
int status = 0;
uint64_t start = current_time_ms();
for (;;) {
if (waitpid(-1, &status, WNOHANG | WAIT_FLAGS) == pid)
break;
sleep_ms(1);
if (current_time_ms() - start < 5000)
continue;
kill_and_wait(pid, &status);
break;
}
}
}
uint64_t r[2] = {0xffffffffffffffff, 0xffffffffffffffff};
void execute_call(int call)
{
intptr_t res = 0;
switch (call) {
case 0:
memcpy((void*)0x20000140, "/dev/cec#\000", 10);
res = -1;
res = syz_open_dev(/*dev=*/0x20000140, /*id=*/0 + procid*1, /*flags=*/0);
if (res != -1)
r[0] = res;
break;
case 1:
*(uint64_t*)0x20000200 = 0;
*(uint64_t*)0x20000208 = 0x10001;
*(uint32_t*)0x20000210 = 9;
*(uint32_t*)0x20000214 = 0x80000001;
*(uint32_t*)0x20000218 = 0xffff;
*(uint32_t*)0x2000021c = 0xd3a6383;
memcpy((void*)0x20000220, "\xb0\x37\x80\xe7\x3a\x10\x88\x3f\x6f\x4e\x5b\x71\x69\x6c\xff\xfb", 16);
*(uint8_t*)0x20000230 = 3;
*(uint8_t*)0x20000231 = 0x3f;
*(uint8_t*)0x20000232 = 6;
*(uint8_t*)0x20000233 = 0xa0;
*(uint8_t*)0x20000234 = 8;
*(uint8_t*)0x20000235 = 1;
*(uint8_t*)0x20000236 = 1;
syscall(__NR_ioctl, /*fd=*/r[0], /*cmd=*/0xc0386105, /*arg=*/0x20000200ul);
break;
case 2:
memcpy((void*)0x20000000, "/dev/cec#\000", 10);
res = -1;
res = syz_open_dev(/*dev=*/0x20000000, /*id=*/0 + procid*1, /*flags=*/0);
if (res != -1)
r[1] = res;
break;
case 3:
memcpy((void*)0x20000240, "\xed\x95\xe5\x72", 4);
*(uint16_t*)0x20000244 = 0x7fff;
*(uint8_t*)0x20000246 = 6;
*(uint8_t*)0x20000247 = 0xb6;
*(uint32_t*)0x20000248 = 7;
*(uint32_t*)0x2000024c = 0xffff;
memcpy((void*)0x20000250, "\xad\x79\x7c\xea\x67\xb7\x7d\x69\xa9\x6b\x2d\x27\x36\xf5\x94", 15);
memcpy((void*)0x2000025f, "\xc7\x8f\xb0\x97", 4);
memcpy((void*)0x20000263, "\x6f\xf7\xda\x47", 4);
memcpy((void*)0x20000267, "\x62\x10\x53\x1d", 4);
memcpy((void*)0x2000026b, "\x24\x30\x00\x24\x5f\x24\x4e\xd3\xc9\x82\x4b\x4e", 12);
memcpy((void*)0x20000277, "\x1b\x08\x52\x86\xdb\x34\xc9\x0b\x15\x60\xc0\xb9", 12);
memcpy((void*)0x20000283, "\x0d\xc9\xfa\x2d\x07\x7a\x5a\x0c\xb4\x0b\x11\xaf", 12);
memcpy((void*)0x2000028f, "\x03\x7e\x04\x95\xb2\x1e\x40\xdd\x99\x8d\x32\x32", 12);
syscall(__NR_ioctl, /*fd=*/r[1], /*cmd=*/0xc05c6104, /*arg=*/0x20000240ul);
break;
}
}
int main(void)
{
syscall(__NR_mmap, /*addr=*/0x1ffff000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=*/0x32ul, /*fd=*/-1, /*offset=*/0ul);
syscall(__NR_mmap, /*addr=*/0x20000000ul, /*len=*/0x1000000ul, /*prot=*/7ul, /*flags=*/0x32ul, /*fd=*/-1, /*offset=*/0ul);
syscall(__NR_mmap, /*addr=*/0x21000000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=*/0x32ul, /*fd=*/-1, /*offset=*/0ul);
for (procid = 0; procid < 8; procid++) {
if (fork() == 0) {
loop();
}
}
sleep(1000000);
return 0;
}
next prev parent reply other threads:[~2024-02-13 16:46 UTC|newest]
Thread overview: 25+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-12-28 2:33 [Linux Kernel Bugs] KASAN: slab-use-after-free Read in cec_queue_msg_fh and 4 other crashes in the cec device (`cec_ioctl`) Yang, Chenyuan
2023-12-29 6:23 ` Dmitry Vyukov
[not found] ` <SN6PR11MB345527101A2C8A1AC99B04B5FA712@SN6PR11MB3455.namprd11.prod.outlook.com>
2024-01-18 7:52 ` Hans Verkuil
2024-01-19 8:17 ` Hans Verkuil
2024-01-22 19:11 ` Yang, Chenyuan
2024-01-23 8:02 ` Hans Verkuil
2024-01-23 10:39 ` Hans Verkuil
2024-01-24 13:33 ` Yang, Chenyuan
2024-01-25 10:35 ` Hans Verkuil
2024-01-29 3:03 ` Yang, Chenyuan
2024-01-30 14:35 ` Hans Verkuil
2024-02-12 14:42 ` Hans Verkuil
2024-02-13 15:40 ` Yang, Chenyuan
2024-02-13 16:05 ` Yang, Chenyuan [this message]
2024-02-23 14:44 ` Hans Verkuil
[not found] ` <PH7PR11MB5768B0BC3C042A6EA4EC1EF0A0542@PH7PR11MB5768.namprd11.prod.outlook.com>
2024-02-26 12:27 ` Yang, Chenyuan
2024-04-19 14:51 ` Takashi Iwai
2024-04-22 12:14 ` Hans Verkuil
2024-04-22 19:30 ` Takashi Iwai
2024-04-22 15:04 ` Hans Verkuil
2024-04-22 18:54 ` Yang, Chenyuan
2024-04-22 20:57 ` Hans Verkuil
2024-04-29 15:42 ` Yang, Chenyuan
2024-04-30 10:26 ` Hans Verkuil
2024-04-30 17:06 ` Yang, Chenyuan
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=0C7B75A2-B4C8-43CB-A57A-910B3674E787@illinois.edu \
--to=cy54@illinois.edu \
--cc=hverkuil-cisco@xs4all.nl \
--cc=jani.nikula@intel.com \
--cc=lingming@illinois.edu \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-media@vger.kernel.org \
--cc=mchehab@kernel.org \
--cc=syzkaller@googlegroups.com \
--cc=zijie4@illinois.edu \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).