linux-kernel - [BUG] NULL pointer dereference probably caused by kernel/trace/ring

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAM6Wdxc0KRJMXVAA0Y=u6Jh2V=uWB-_Fn6M4xRuNppfXzL1mUg@mail.gmail.com>
Date:   Mon, 31 Oct 2022 14:02:12 +0100
From:   Roland Ruckerbauer <roland.rucky@...il.com>
To:     Steven Rostedt <rostedt@...dmis.org>,
        Masami Hiramatsu <mhiramat@...nel.org>
Cc:     linux-kernel@...r.kernel.org
Subject: [BUG] NULL pointer dereference probably caused by kernel/trace/ring_buffer.c

Somewhere between kernel 6.0.2 and 6.0.5 I started getting crashes
when https://github.com/mchehab/rasdaemon is starting.

After investigating a bit, I found the following commits:
a6b4d8d6656f ring-buffer: Fix race between reset page and reading page
fa76ee6fea9c ring-buffer: Add ring_buffer_wake_waiters()
7bf3c4d84204 ring-buffer: Check pending waiters when doing wake ups as well
692cc072c800 ring-buffer: Have the shortest_full queue be the shortest
not longest
57af2334ca70 ring-buffer: Allow splice to read previous partially read pages

I guess one of them must have broken something rasdaemon is using,
since the crash is in ring_buffer_wake_waiters(), and it was first
introduced by this commit series.

The crash report is attached in dmesg.log.

For me the crash is easily reproducible. For testing I run 6.0.5
upstream kernel, but I guess everything since 6.0.3 is affected as
well.

My hardware (hopefully irrelevant): x570 amd platform (ryzen 5000)

If I can help in any way, please say so (testing patches etc ...).

Thanks,
Roland Ruckerbauer

View attachment "dmesg.log" of type "text/x-log" (4234 bytes)