linux-kernel - arm64: libgpiod: refcount_t: underflow; use-after-free.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <CA+G9fYs4JsmNxX4+W=wijfSPdDsOy=SWLBSitZper5ncPpdxqA@mail.gmail.com>
Date:   Mon, 20 Feb 2023 20:29:27 +0530
From:   Naresh Kamboju <naresh.kamboju@...aro.org>
To:     Linux Media Mailing List <linux-media@...r.kernel.org>,
        open list <linux-kernel@...r.kernel.org>,
        "open list:GPIO SUBSYSTEM" <linux-gpio@...r.kernel.org>,
        lkft-triage@...ts.linaro.org
Cc:     Bartosz Golaszewski <brgl@...ev.pl>,
        Andy Shevchenko <andriy.shevchenko@...ux.intel.com>,
        Ferry Toth <fntoth@...il.com>,
        Linus Walleij <linus.walleij@...aro.org>, warthog618@...il.com,
        Arnd Bergmann <arnd@...db.de>
Subject: arm64: libgpiod: refcount_t: underflow; use-after-free.

Following kernel warning notices on qemu-arm64, qemu-arm and also on devices
running Linux version v6.2.0 while running libgpiod tests.

+ ./gpiod.sh /opt/libgpiod/bin/
  [INFO]    libgpiod test suite
  [INFO]    117 tests registered
  [INFO]    checking the linux kernel version
  [INFO]    kernel release is v6.2.0 - ok to run tests
  [INFO]    using gpio-tools from '/usr/bin'
[   10.499036] ------------[ cut here ]------------
[   10.499656] refcount_t: underflow; use-after-free.
[   10.500264] WARNING: CPU: 2 PID: 291 at lib/refcount.c:28
refcount_warn_saturate+0xf4/0x144
[   10.501306] Modules linked in: gpio_mockup(-) cfg80211 bluetooth
rfkill crct10dif_ce fuse drm
[   10.502364] CPU: 2 PID: 291 Comm: gpiod-test Not tainted 6.2.0 #1
[   10.503229] Hardware name: linux,dummy-virt (DT)
[   10.503883] pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
[   10.505331] pc : refcount_warn_saturate+0xf4/0x144
[   10.505723] lr : refcount_warn_saturate+0xf4/0x144
[   10.506115] sp : ffff800008983cd0
[   10.506391] x29: ffff800008983cd0 x28: ffff0000c4c4c100 x27: 0000000000000000
[   10.506961] x26: 0000000000000000 x25: 0000000000000000 x24: 0000000000000000
[   10.507533] x23: 0000000000000200 x22: ffff0000c4e66800 x21: ffff0000c7734640
[   10.508104] x20: 0000000000000001 x19: ffff0000c7734600 x18: ffffffffffffffff
[   10.508677] x17: 3d4d455453595342 x16: ffffcf0234432020 x15: ffff800088983957
[   10.509424] x14: 0000000000000000 x13: 2e656572662d7265 x12: 7466612d65737520
[   10.510003] x11: 3b776f6c66726564 x10: ffffcf02365db580 x9 : ffffcf0233b20138
[   10.510575] x8 : 00000000ffffefff x7 : ffffcf02365db580 x6 : 0000000000000001
[   10.511145] x5 : ffffcf023655f000 x4 : ffffcf023655f2e8 x3 : 0000000000000000
[   10.511721] x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff0000c4c4c100
[   10.512294] Call trace:
[   10.512494]  refcount_warn_saturate+0xf4/0x144
[   10.512971]  kobject_put+0x164/0x220
[   10.513224]  fwnode_remove_software_node+0x44/0x60
[   10.513554]  gpio_mockup_unregister_pdevs+0x54/0x70 [gpio_mockup]
[   10.513970]  gpio_mockup_exit+0x10/0x328 [gpio_mockup]
[   10.514322]  __arm64_sys_delete_module+0x190/0x2a0
[   10.514653]  invoke_syscall+0x50/0x120
[   10.514915]  el0_svc_common.constprop.0+0x104/0x124
[   10.515277]  do_el0_svc+0x44/0xcc
[   10.515541]  el0_svc+0x30/0x94
[   10.515788]  el0t_64_sync_handler+0xbc/0x13c
[   10.516126]  el0t_64_sync+0x190/0x194
[   10.516419] ---[ end trace 0000000000000000 ]---


Build and test logs,
https://qa-reports.linaro.org/lkft/linux-mainline-master/build/v6.2/testrun/14856342/suite/libgpiod/test/ctxless-get-value-single-line/log
https://qa-reports.linaro.org/lkft/linux-mainline-master/build/v6.2/testrun/14856342/suite/libgpiod/tests/


--
Linaro LKFT
https://lkft.linaro.org