| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-Id: <1516094147-4597-1-git-send-email-hiraku.toyooka@cybertrust.co.jp>
Date: Tue, 16 Jan 2018 18:15:46 +0900
From: Hiraku Toyooka <hiraku.toyooka@...ertrust.co.jp>
To: bhelgaas@...gle.com
Cc: Hiraku Toyooka <hiraku.toyooka@...ertrust.co.jp>,
linux-pci@...r.kernel.org, linux-arm-kernel@...ts.infradead.org,
linux-kernel@...r.kernel.org, hongxing.zhu@....com,
l.stach@...gutronix.de, jingoohan1@...il.com,
Joao.Pinto@...opsys.com, lorenzo.pieralisi@....com,
linux@...linux.org.uk, will.deacon@....com
Subject: [PATCH 0/1] PCI/MSI: add NULL check before use of msi_desc
Hello,
I found a NULL pointer dereference in PCI/MSI when I tried to run kdump
kernel on i.MX6(MCIMX6Q-SDB). This error occurs when masking MSI irq
which does not have msi_desc.
I added NULL check to avoid the error, and kdump worked fine. But I'm
not sure this is correct way. What do you think about this fix?
My environment:
- Board: MCIMX6Q-SDB
- Kernel: 4.15.0-rc5 (commit: 464e1d5f23)
- used also as kdump kernel
- CONFIG_CRASH_DUMP and CONFIG_DEBUG_INFO are enabled based on imx_v6_v7_defconfig
- U-Boot: u-boot-fslc (2017.11+fslc branch)
- built with meta-freescale (commit: bf7fd9cfe0)
Console log in failure case (patch not applied):
root@...6qdlsabresd:~# cat /proc/cmdline
console=ttymxc0,115200 root=PARTUUID=6c7357c5-02 rootwait rw quiet crashkernel=96M
root@...6qdlsabresd:~# kexec --type zImage -p /boot/zImage --dtb=/boot/imx6q-sabresd.dtb --append="console=ttymxc0,115200 root=/dev/mmcblk1p2 rootwait rw 3 maxcpus=1 reset_devices earlycon"
root@...6qdlsabresd:~# echo c > /proc/sysrq-trigger
[ 27.590895] sysrq: SysRq : Trigger a crash
[ 27.595250] Unable to handle kernel NULL pointer dereference at virtual address 00000000
...(snip)...
[ 27.808001] Backtrace:
[ 27.810502] [<c04d1a58>] (sysrq_handle_crash) from [<c04d206c>] (__handle_sysrq+0xd8/0x258)
[ 27.818877] r5:00000063 r4:c101a6b0
[ 27.822489] [<c04d1f94>] (__handle_sysrq) from [<c04d2688>] (write_sysrq_trigger+0x78/0x90)
[ 27.830871] r10:00000000 r9:00000002 r8:00000000 r7:e6490c00 r6:00000000 r5:01ced738
[ 27.838719] r4:00000002
[ 27.841290] [<c04d2610>] (write_sysrq_trigger) from [<c02979bc>] (proc_reg_write+0x68/0x90)
[ 27.849664] r5:00000000 r4:c04d2610
[ 27.853277] [<c0297954>] (proc_reg_write) from [<c022e50c>] (__vfs_write+0x34/0x134)
[ 27.861050] r9:00000002 r8:01ced738 r7:00000002 r6:e71a9f78 r5:c0297954 r4:e6a49cc0
[ 27.868824] [<c022e4d8>] (__vfs_write) from [<c022e78c>] (vfs_write+0xa8/0x170)
[ 27.876162] r9:00000002 r8:01ced738 r7:e71a9f78 r6:01ced738 r5:e6a49cc0 r4:00000002
[ 27.883936] [<c022e6e4>] (vfs_write) from [<c022e96c>] (SyS_write+0x44/0x98)
[ 27.891014] r9:00000002 r8:01ced738 r7:00000000 r6:00000000 r5:e6a49cc0 r4:e6a49cc0
[ 27.898797] [<c022e928>] (SyS_write) from [<c0107fe0>] (ret_fast_syscall+0x0/0x28)
[ 27.906395] r9:e71a8000 r8:c01081a4 r7:00000004 r6:b6f7eda8 r5:01ced738 r4:00000002
[ 27.914169] Code: e3a04000 e5835000 ee074f9a ebf11af2 (e5c45000)
[ 27.920332] CPU 1 will stop doing anything useful since another CPU has crashed
[ 27.920342] CPU 0 will stop doing anything useful since another CPU has crashed
[ 27.920351] CPU 2 will stop doing anything useful since another CPU has crashed
[ 27.949670] Unable to handle kernel NULL pointer dereference at virtual address 00000028
[ 27.957798] pgd = c30fc51b
[ 27.960529] [00000028] *pgd=4a140831
[ 27.964144] Internal error: Oops: 17 [#2] SMP ARM
[ 27.968869] Modules linked in:
[ 27.971962] CPU: 3 PID: 399 Comm: sh Not tainted 4.15.0-rc5-g3630470 #15
[ 27.978685] Hardware name: Freescale i.MX6 Quad/DualLite (Device Tree)
[ 27.985248] PC is at msi_set_mask_bit+0x18/0x6c
[ 27.989805] LR is at pci_msi_mask_irq+0x14/0x18
[ 27.994358] pc : [<c0485ee4>] lr : [<c0485f4c>] psr: a0000193
[ 28.000647] sp : e71a9bb0 ip : e71a9bc8 fp : e71a9bc4
[ 28.005892] r10: ffffe000 r9 : e682e400 r8 : c101a72c
[ 28.011140] r7 : e71a9c00 r6 : c102a504 r5 : 0000012f r4 : 00000000
[ 28.017690] r3 : e642b400 r2 : 00000001 r1 : 00000001 r0 : e642b414
[ 28.024241] Flags: NzCv IRQs off FIQs on Mode SVC_32 ISA ARM Segment none
[ 28.031486] Control: 10c5387d Table: 36ef804a DAC: 00000051
[ 28.037255] Process sh (pid: 399, stack limit = 0x61f128fb)
[ 28.042849] Stack: (0xe71a9bb0 to 0xe71aa000)
...(snip)...
[ 28.334445] Backtrace:
[ 28.336937] [<c0485ecc>] (msi_set_mask_bit) from [<c0485f4c>] (pci_msi_mask_irq+0x14/0x18)
[ 28.345224] r5:0000012f r4:e642b400
[ 28.348844] [<c0485f38>] (pci_msi_mask_irq) from [<c0111308>] (machine_crash_shutdown+0xe8/0x1a0)
[ 28.357763] [<c0111220>] (machine_crash_shutdown) from [<c01b4aa4>] (__crash_kexec+0x5c/0xa0)
[ 28.366319] r9:e682e400 r8:bf000000 r7:c100d9e4 r6:c17c9c88 r5:e71a9df0 r4:e71a9c00
[ 28.374097] [<c01b4a48>] (__crash_kexec) from [<c01b4b58>] (crash_kexec+0x70/0x80)
[ 28.381691] r6:0000000b r5:ffffffff r4:c10155ac
[ 28.386341] [<c01b4ae8>] (crash_kexec) from [<c010ce8c>] (die+0x230/0x368)
[ 28.393239] r5:e71a9df0 r4:c107b21c
[ 28.396848] [<c010cc5c>] (die) from [<c0116b80>] (__do_kernel_fault.part.0+0x5c/0x7c)
[ 28.404707] r10:e69c96d4 r9:00000000 r8:00000817 r7:e69c9680 r6:00000817 r5:e71a9df0
[ 28.412556] r4:00000000
[ 28.415123] [<c0116b24>] (__do_kernel_fault.part.0) from [<c01169a0>] (do_page_fault+0x3a4/0x3c4)
[ 28.424017] r7:e69c9680 r4:e71a9df0
[ 28.427623] [<c01165fc>] (do_page_fault) from [<c0101388>] (do_DataAbort+0x3c/0xbc)
[ 28.435310] r10:00000000 r9:e71a8000 r8:e71a9df0 r7:00000000 r6:c01165fc r5:00000817
[ 28.443159] r4:c100e4a0
[ 28.445723] [<c010134c>] (do_DataAbort) from [<c010d804>] (__dabt_svc+0x64/0xa0)
[ 28.453140] Exception stack(0xe71a9df0 to 0xe71a9e38)
[ 28.458217] 9de0: 00000000 00000730 00000000 00000000
[ 28.466423] 9e00: 00000000 00000001 c10359a0 00000000 00000004 00000002 00000000 e71a9e54
[ 28.474627] 9e20: e71a9e30 e71a9e40 c0118694 c04d1aa8 60000013 ffffffff
[ 28.481268] r8:00000004 r7:e71a9e24 r6:ffffffff r5:60000013 r4:c04d1aa8
[ 28.488012] [<c04d1a58>] (sysrq_handle_crash) from [<c04d206c>] (__handle_sysrq+0xd8/0x258)
[ 28.496385] r5:00000063 r4:c101a6b0
[ 28.499995] [<c04d1f94>] (__handle_sysrq) from [<c04d2688>] (write_sysrq_trigger+0x78/0x90)
[ 28.508375] r10:00000000 r9:00000002 r8:00000000 r7:e6490c00 r6:00000000 r5:01ced738
[ 28.516223] r4:00000002
[ 28.518791] [<c04d2610>] (write_sysrq_trigger) from [<c02979bc>] (proc_reg_write+0x68/0x90)
[ 28.527164] r5:00000000 r4:c04d2610
[ 28.530774] [<c0297954>] (proc_reg_write) from [<c022e50c>] (__vfs_write+0x34/0x134)
[ 28.538547] r9:00000002 r8:01ced738 r7:00000002 r6:e71a9f78 r5:c0297954 r4:e6a49cc0
[ 28.546320] [<c022e4d8>] (__vfs_write) from [<c022e78c>] (vfs_write+0xa8/0x170)
[ 28.553658] r9:00000002 r8:01ced738 r7:e71a9f78 r6:01ced738 r5:e6a49cc0 r4:00000002
[ 28.561433] [<c022e6e4>] (vfs_write) from [<c022e96c>] (SyS_write+0x44/0x98)
[ 28.568511] r9:00000002 r8:01ced738 r7:00000000 r6:00000000 r5:e6a49cc0 r4:e6a49cc0
[ 28.576291] [<c022e928>] (SyS_write) from [<c0107fe0>] (ret_fast_syscall+0x0/0x28)
[ 28.583890] r9:e71a8000 r8:c01081a4 r7:00000004 r6:b6f7eda8 r5:01ced738 r4:00000002
[ 28.591662] Code: e24cb004 e590300c e1a02001 e5934008 (e5d43028)
[ 28.597788] ---[ end trace b7f10c526986d6ea ]---
[ 28.602430] Kernel panic - not syncing: Fatal exception
[ 28.607716] ---[ end Kernel panic - not syncing: Fatal exception
Console log in success case (patch applied):
root@...6qdlsabresd:~# cat /proc/cmdline
console=ttymxc0,115200 root=PARTUUID=6c7357c5-02 rootwait rw quiet crashkernel=96M
root@...6qdlsabresd:~# kexec --type zImage -p /boot/zImage --dtb=/boot/imx6q-sabresd.dtb --append="console=ttymxc0,115200 root=/dev/mmcblk1p2 rootwait rw 3 maxcpus=1 reset_devices earlycon"
root@...6qdlsabresd:~# echo c > /proc/sysrq-trigger
[ 42.951366] sysrq: SysRq : Trigger a crash
[ 42.955711] Unable to handle kernel NULL pointer dereference at virtual address 00000000
...(snip)...
[ 43.167849] Backtrace:
[ 43.170314] [<c04d1a5c>] (sysrq_handle_crash) from [<c04d2070>] (__handle_sysrq+0xd8/0x258)
[ 43.178671] r5:00000063 r4:c101a6b0
[ 43.182258] [<c04d1f98>] (__handle_sysrq) from [<c04d268c>] (write_sysrq_trigger+0x78/0x90)
[ 43.190617] r10:00000000 r9:00000002 r8:00000000 r7:e6490c00 r6:00000000 r5:003b2738
[ 43.198450] r4:00000002
[ 43.200995] [<c04d2614>] (write_sysrq_trigger) from [<c02979bc>] (proc_reg_write+0x68/0x90)
[ 43.209350] r5:00000000 r4:c04d2614
[ 43.212937] [<c0297954>] (proc_reg_write) from [<c022e50c>] (__vfs_write+0x34/0x134)
[ 43.220688] r9:00000002 r8:003b2738 r7:00000002 r6:e6f33f78 r5:c0297954 r4:e6b47680
[ 43.228439] [<c022e4d8>] (__vfs_write) from [<c022e78c>] (vfs_write+0xa8/0x170)
[ 43.235756] r9:00000002 r8:003b2738 r7:e6f33f78 r6:003b2738 r5:e6b47680 r4:00000002
[ 43.243508] [<c022e6e4>] (vfs_write) from [<c022e96c>] (SyS_write+0x44/0x98)
[ 43.250564] r9:00000002 r8:003b2738 r7:00000000 r6:00000000 r5:e6b47680 r4:e6b47680
[ 43.258320] [<c022e928>] (SyS_write) from [<c0107fe0>] (ret_fast_syscall+0x0/0x28)
[ 43.265896] r9:e6f32000 r8:c01081a4 r7:00000004 r6:b6f0eda8 r5:003b2738 r4:00000002
[ 43.273647] Code: e3a04000 e5835000 ee074f9a ebf11af1 (e5c45000)
[ 43.279767] CPU 3 will stop doing anything useful since another CPU has crashed
[ 43.279771] CPU 2 will stop doing anything useful since another CPU has crashed
[ 43.279775] CPU 0 will stop doing anything useful since another CPU has crashed
[ 43.301962] Loading crashdump kernel...
[ 43.305886] Bye!
[ 0.000000] Booting Linux on physical CPU 0x1
[ 0.000000] Linux version 4.15.0-rc5-g13f566e (miracle@ar) (gcc version 5.4.0 20160609 (Ubuntu/Linaro 5.4.0-6ubuntu1~16.04.4)) #14 SMP Tue Jan 16 06:33:27 UTC 2018
Hiraku Toyooka (1):
PCI/MSI: add NULL check before use of msi_desc
drivers/pci/msi.c | 3 +++
1 file changed, 3 insertions(+)
--
2.7.4
Powered by blists - more mailing lists