linux-kernel - Re: cdrom: cdrom_mrw

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <7kbmle3wlpeqcnfieelypkxzypfxoh7bqmuqn2d3hbjgbcm7mt@cze3mv7htbeg>
Date: Mon, 14 Jul 2025 12:10:16 +0900
From: Sergey Senozhatsky <senozhatsky@...omium.org>
To: Phillip Potter <phil@...lpotter.co.uk>
Cc: Sergey Senozhatsky <senozhatsky@...omium.org>, 
	Jens Axboe <axboe@...nel.dk>, Christoph Hellwig <hch@...radead.org>, 
	Chris Rankin <rankincj@...il.com>, linux-kernel@...r.kernel.org, linux-block@...r.kernel.org
Subject: Re: cdrom: cdrom_mrw_exit() NULL ptr deref

On (25/07/11 21:46), Phillip Potter wrote:
> > <1>[335443.339244] BUG: kernel NULL pointer dereference, address: 0000000000000010
> > <1>[335443.339262] #PF: supervisor read access in kernel mode
> > <1>[335443.339268] #PF: error_code(0x0000) - not-present page
> > <6>[335443.339273] PGD 0 P4D 0
> > <4>[335443.339279] Oops: 0000 [#1] PREEMPT SMP NOPTI
> > <4>[335443.339287] CPU: 1 PID: 1988 Comm: cros-disks Not tainted 6.6.76-07501-gd42535a678fb #1 (HASH:7d84 1)
> > <4>[335443.339301] RIP: 0010:blk_queue_enter+0x5a/0x250
> > <4>[335443.339312] Code: 03 00 00 4c 8d 6d a8 eb 1c 4c 89 e7 4c 89 ee e8 8c 62 be ff 49 f7 86 88 00 00 00 02 00 00 00 0f 85 ce 01 00 00 e8 86 10 bd ff <49> 8b 07 a8 03 0f 85 85 01 00 00 65 48 ff 00 41 83 be 90 00 00 00
> > <4>[335443.339318] RSP: 0018:ffff9be08ab03b00 EFLAGS: 00010202
> > <4>[335443.339324] RAX: ffff8903aa366300 RBX: 0000000000000000 RCX: ffff9be08ab03cd0
> > <4>[335443.339330] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
> > <4>[335443.339333] RBP: ffff9be08ab03b58 R08: 0000000000000002 R09: 0000000000001b58
> > <4>[335443.339338] R10: ffffffff00000000 R11: ffffffffc0ccd030 R12: 0000000000000328
> > <4>[335443.339344] R13: ffff9be08ab03b00 R14: 0000000000000000 R15: 0000000000000010
> > <4>[335443.339348] FS: 00007d52be81e900(0000) GS:ffff8904b6040000(0000) knlGS:0000000000000000
> > <4>[335443.339357] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> > <4>[335443.339362] CR2: 0000000000000010 CR3: 0000000140ac6000 CR4: 0000000000350ee0
> > <4>[335443.339367] Call Trace:
> > <4>[335443.339372] <TASK>
> > <4>[335443.339379] ? __die_body+0xae/0xb0
> > <4>[335443.339389] ? page_fault_oops+0x381/0x3e0
> > <4>[335443.339398] ? exc_page_fault+0x4f/0xa0
> > <4>[335443.339404] ? asm_exc_page_fault+0x22/0x30
> > <4>[335443.339416] ? sr_check_events+0x290/0x290 [sr_mod (HASH:ab3e 2)]
> > <4>[335443.339432] ? blk_queue_enter+0x5a/0x250
> > <4>[335443.339439] blk_mq_alloc_request+0x16a/0x220
> > <4>[335443.339450] scsi_execute_cmd+0x65/0x240
> > <4>[335443.339458] sr_do_ioctl+0xe3/0x210 [sr_mod (HASH:ab3e 2)]
> > <4>[335443.339471] sr_packet+0x3d/0x50 [sr_mod (HASH:ab3e 2)]
> > <4>[335443.339482] cdrom_mrw_exit+0xc1/0x240 [cdrom (HASH:9d9a 3)]
> > <4>[335443.339497] sr_free_disk+0x45/0x60 [sr_mod (HASH:ab3e 2)]
> > <4>[335443.339506] disk_release+0xc8/0xe0
> > <4>[335443.339515] device_release+0x39/0x90
> > <4>[335443.339523] kobject_release+0x49/0xb0
> > <4>[335443.339533] bdev_release+0x19/0x30
> > <4>[335443.339540] deactivate_locked_super+0x3b/0x100
> > <4>[335443.339548] cleanup_mnt+0xaa/0x160
> > <4>[335443.339557] task_work_run+0x6c/0xb0
> > <4>[335443.339563] exit_to_user_mode_prepare+0x102/0x120
> > <4>[335443.339571] syscall_exit_to_user_mode+0x1a/0x30
> > <4>[335443.339577] do_syscall_64+0x7e/0xa0
> > <4>[335443.339582] ? exit_to_user_mode_prepare+0x44/0x120
> > <4>[335443.339588] entry_SYSCALL_64_after_hwframe+0x55/0xbf
> > <4>[335443.339595] RIP: 0033:0x7d52bea41f07
> > 
> > [1] https://lore.kernel.org/all/CAK2bqVJGsz8r8D-x=4N6p9nXQ=v4AwpMAg2frotmdSdtjvnexg@mail.gmail.com/
> 
> Hi Sergey,

Hi Phillip,
Sorry for the delay in replying.

> I have not been aware of this issue until now, as it pertains to the Uniform
> CD-ROM driver, wasn't copied on the original bug report. Happy to do some
> debugging by all means though. Please could you give me some more information
> about how you're triggering it - i.e. is it particular discs? I am grateful
> for any information you can provide.

Doesn't seem to be specific to any particular disc, all sorts of
external CD/DVD drives that people attach to their laptops pop up
in the logs, e.g.:

<6>[333586.844993] usb 3-2: Product: Portable Super Multi Drive
<6>[333586.844998] usb 3-2: Manufacturer: Hitachi-LG Data Storage Inc
<5>[333587.915913] scsi 0:0:0:0: CD-ROM HL-DT-ST DVDRAM GP65NB60 PF00 PQ: 0 ANSI: 0
[..]

<6>[ 66.541922] usb-storage 3-2:1.0: USB Mass Storage device detected
<6>[ 66.542114] scsi host0: usb-storage 3-2:1.0
<5>[ 67.561667] scsi 0:0:0:0: CD-ROM Slimtype ES1 7L0M PQ: 0 ANSI: 0
[..]

<6>[26205.264565] usb 3-2: Manufacturer: JMicron
<6>[26205.267414] usb-storage 3-2:1.0: USB Mass Storage device detected
<6>[26205.267857] scsi host0: usb-storage 3-2:1.0
<5>[26206.329294] scsi 0:0:0:0: CD-ROM hp DVDRAM GT31L MR52 PQ: 0 ANSI: 0
[..]

And as soon as people detach the drives from their laptops, we get
the NULL queue dereference:

<6>[26369.017083] usb 3-2: USB disconnect, device number 2
<1>[26369.346200] BUG: kernel NULL pointer dereference, address: 0000000000000010
<1>[26369.346209] #PF: supervisor read access in kernel mode
<1>[26369.346213] #PF: error_code(0x0000) - not-present page
<6>[26369.346216] PGD 0 P4D 0
<4>[26369.346221] Oops: 0000 [#1] PREEMPT SMP NOPTI
<4>[26369.346226] CPU: 4 PID: 1787 Comm: cros-disks Not tainted 6.6.76-08054-g1b09a1d2f6c9 #1 (HASH:42d6 4)
<4>[26369.346235] RIP: 0010:blk_queue_enter+0x5a/0x250
[..]

The device is detached already, I assume there isn't much that
cdrom_mrw_exit() can do at that point.