linux-kernel - Re: [PATCH v1] sysfs: fix sysfs_kf_seq

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <Yqu6SeqVlumtHVL3@google.com>
Date:   Thu, 16 Jun 2022 23:18:33 +0000
From:   William McVicker <willmcvicker@...gle.com>
To:     Christoph Hellwig <hch@....de>
Cc:     Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        "Rafael J. Wysocki" <rafael@...nel.org>, Tejun Heo <tj@...nel.org>,
        kernel-team@...roid.com, linux-kernel@...r.kernel.org
Subject: Re: [PATCH v1] sysfs: fix sysfs_kf_seq_show null pointer dereference

On 06/15/2022, Christoph Hellwig wrote:
> On Tue, Jun 14, 2022 at 07:28:31PM +0200, Greg Kroah-Hartman wrote:
> > On Tue, Jun 14, 2022 at 05:24:01PM +0000, Will McVicker wrote:
> > > When the kobj->ktype is null,
> > 
> > How can that happen?  What in-tree code does that?
> 
> Yes, I'd be really curious how we arrived there.  I we ever end in
> this case we're having a major problem, as all the sysfs files
> should go through sysfs_add_file_mode_ns, which already derferences
> kobj->ktype->sysfs_ops directly.  I.e. for this to happen
> kobj->ktype must have been cleared on a live file, or someone
> must have bypassed sysfs_add_file_mode_ns.

Okay, so I was able to figure out that the Android userspace process that
triggers this issue is called rebalance_interrupts. You can find the source
code here [1]. I can reproduce this issue in about 5-10 reboots. As the name
indicates, it rebalances the IRQs. I found that the crash happens when the
program reads the sysfs files: /sys/kernel/irq/<irq>/actions. I haven't looked
into how kobj->ktype becomes null yet. I'll look deeper into that now, but
wanted to update this thread in case this information triggers any hints for
you guys on why this is happening.

Thanks,
Will

[1] https://android.googlesource.com/platform/hardware/google/pixel/+/refs/heads/android12-qpr3-s2-release/rebalance_interrupts