linux-kernel - Re: cdrom: cdrom_mrw

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <aHF4GRvXhM6TnROz@equinox>
Date: Fri, 11 Jul 2025 21:46:17 +0100
From: Phillip Potter <phil@...lpotter.co.uk>
To: Sergey Senozhatsky <senozhatsky@...omium.org>
Cc: Jens Axboe <axboe@...nel.dk>, Christoph Hellwig <hch@...radead.org>,
	Chris Rankin <rankincj@...il.com>, linux-kernel@...r.kernel.org,
	linux-block@...r.kernel.org,
	Sergey Senozhatsky <senozhatsky@...omium.org>,
	Phillip Potter <phil@...lpotter.co.uk>
Subject: Re: cdrom: cdrom_mrw_exit() NULL ptr deref

On Fri, Jul 11, 2025 at 04:04:17PM +0900, Sergey Senozhatsky wrote:
> Hi,
> 
> We are seeing the same NULL ptr deref upon cdrom release, as reported
> in [1] (Chris Cc-ed) in our fleet.  Currently on 6.6 LTS (could be the
> same for older kernels as well, I didn't check.)
> 
> Phillip, is this a known issue?
> 
> <1>[335443.339244] BUG: kernel NULL pointer dereference, address: 0000000000000010
> <1>[335443.339262] #PF: supervisor read access in kernel mode
> <1>[335443.339268] #PF: error_code(0x0000) - not-present page
> <6>[335443.339273] PGD 0 P4D 0
> <4>[335443.339279] Oops: 0000 [#1] PREEMPT SMP NOPTI
> <4>[335443.339287] CPU: 1 PID: 1988 Comm: cros-disks Not tainted 6.6.76-07501-gd42535a678fb #1 (HASH:7d84 1)
> <4>[335443.339301] RIP: 0010:blk_queue_enter+0x5a/0x250
> <4>[335443.339312] Code: 03 00 00 4c 8d 6d a8 eb 1c 4c 89 e7 4c 89 ee e8 8c 62 be ff 49 f7 86 88 00 00 00 02 00 00 00 0f 85 ce 01 00 00 e8 86 10 bd ff <49> 8b 07 a8 03 0f 85 85 01 00 00 65 48 ff 00 41 83 be 90 00 00 00
> <4>[335443.339318] RSP: 0018:ffff9be08ab03b00 EFLAGS: 00010202
> <4>[335443.339324] RAX: ffff8903aa366300 RBX: 0000000000000000 RCX: ffff9be08ab03cd0
> <4>[335443.339330] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
> <4>[335443.339333] RBP: ffff9be08ab03b58 R08: 0000000000000002 R09: 0000000000001b58
> <4>[335443.339338] R10: ffffffff00000000 R11: ffffffffc0ccd030 R12: 0000000000000328
> <4>[335443.339344] R13: ffff9be08ab03b00 R14: 0000000000000000 R15: 0000000000000010
> <4>[335443.339348] FS: 00007d52be81e900(0000) GS:ffff8904b6040000(0000) knlGS:0000000000000000
> <4>[335443.339357] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> <4>[335443.339362] CR2: 0000000000000010 CR3: 0000000140ac6000 CR4: 0000000000350ee0
> <4>[335443.339367] Call Trace:
> <4>[335443.339372] <TASK>
> <4>[335443.339379] ? __die_body+0xae/0xb0
> <4>[335443.339389] ? page_fault_oops+0x381/0x3e0
> <4>[335443.339398] ? exc_page_fault+0x4f/0xa0
> <4>[335443.339404] ? asm_exc_page_fault+0x22/0x30
> <4>[335443.339416] ? sr_check_events+0x290/0x290 [sr_mod (HASH:ab3e 2)]
> <4>[335443.339432] ? blk_queue_enter+0x5a/0x250
> <4>[335443.339439] blk_mq_alloc_request+0x16a/0x220
> <4>[335443.339450] scsi_execute_cmd+0x65/0x240
> <4>[335443.339458] sr_do_ioctl+0xe3/0x210 [sr_mod (HASH:ab3e 2)]
> <4>[335443.339471] sr_packet+0x3d/0x50 [sr_mod (HASH:ab3e 2)]
> <4>[335443.339482] cdrom_mrw_exit+0xc1/0x240 [cdrom (HASH:9d9a 3)]
> <4>[335443.339497] sr_free_disk+0x45/0x60 [sr_mod (HASH:ab3e 2)]
> <4>[335443.339506] disk_release+0xc8/0xe0
> <4>[335443.339515] device_release+0x39/0x90
> <4>[335443.339523] kobject_release+0x49/0xb0
> <4>[335443.339533] bdev_release+0x19/0x30
> <4>[335443.339540] deactivate_locked_super+0x3b/0x100
> <4>[335443.339548] cleanup_mnt+0xaa/0x160
> <4>[335443.339557] task_work_run+0x6c/0xb0
> <4>[335443.339563] exit_to_user_mode_prepare+0x102/0x120
> <4>[335443.339571] syscall_exit_to_user_mode+0x1a/0x30
> <4>[335443.339577] do_syscall_64+0x7e/0xa0
> <4>[335443.339582] ? exit_to_user_mode_prepare+0x44/0x120
> <4>[335443.339588] entry_SYSCALL_64_after_hwframe+0x55/0xbf
> <4>[335443.339595] RIP: 0033:0x7d52bea41f07
> 
> [1] https://lore.kernel.org/all/CAK2bqVJGsz8r8D-x=4N6p9nXQ=v4AwpMAg2frotmdSdtjvnexg@mail.gmail.com/

Hi Sergey,

I have not been aware of this issue until now, as it pertains to the Uniform
CD-ROM driver, wasn't copied on the original bug report. Happy to do some
debugging by all means though. Please could you give me some more information
about how you're triggering it - i.e. is it particular discs? I am grateful
for any information you can provide.

Regards,
Phil