| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <aQbYAXPADqfiXUYO@mail-itl>
Date: Sun, 2 Nov 2025 05:03:13 +0100
From: Marek Marczykowski-Górecki <marmarek@...isiblethingslab.com>
To: Alexander Usyskin <alexander.usyskin@...el.com>
Cc: Arnd Bergmann <arnd@...db.de>,
Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
regressions@...ts.linux.dev, linux-kernel@...r.kernel.org
Subject: [REGRESSION] mei_me_probe NULL ptr deref on error path - 6.18-rc3
Hi,
When trying Linux 6.18-rc3, I'm hitting kernel panic in mei_me driver.
It looks like this:
[ 85.878591] mei mei0: wait hw ready failed
[ 85.878699] mei mei0: hw_start failed ret = -62 fw status = 80022054 30284100 00000020 00000000 02620000 00000000
[ 85.878769] mei mei0: H_RST is set = 0x800E0E31
[ 87.926419] mei mei0: wait hw ready failed
[ 87.926515] mei mei0: hw_start failed ret = -62 fw status = 80022054 30284100 00000020 00000000 02620000 00000000
[ 87.926581] mei mei0: reset: reached maximal consecutive resets: disabling the device
[ 87.926594] mei mei0: reset failed ret = -19
[ 87.926598] mei mei0: link layer initialization failed.
[ 87.926603] mei_me 0000:00:16.0: init hw failure.
[ 87.926769] ------------[ cut here ]------------
[ 87.926774] WARNING: CPU: 9 PID: 518 at kernel/workqueue.c:4234 __flush_work+0x340/0x390
[ 87.926785] Modules linked in: intel_rapl_msr intel_powerclamp i2c_i801 intel_rapl_common snd pcspkr spi_intel_pci rfkill e1000e spi_intel processor_thermal_wt_req i2c_smbus mei_me processor_thermal_power_floor soundcore mei processor_thermal_mbox idma64 intel_pmc_core int340x_thermal_zone igen6_edac pmt_telemetry pmt_discovery pmt_class intel_hid sparse_keymap intel_pmc_ssram_telemetry intel_scu_pltdrv joydev fuse loop xenfs nfnetlink vsock_loopback vmw_vsock_virtio_transport_common zram vmw_vsock_vmci_transport lz4hc_compress vsock vmw_vmci lz4_compress dm_thin_pool dm_persistent_data dm_bio_prison dm_crypt xe drm_ttm_helper drm_suballoc_helper gpu_sched drm_gpuvm drm_exec drm_gpusvm_helper nvme i915 nvme_core sdhci_pci sdhci_uhs2 i2c_algo_bit nvme_keyring drm_buddy sdhci intel_pmc_mux nvme_auth ttm cqhci typec xhci_pci hid_multitouch polyval_clmulni ghash_clmulni_intel mmc_core hkdf intel_vpu intel_vsec xhci_hcd drm_display_helper i2c_hid_acpi i2c_hid thunderbolt video wmi pinctrl_meteorlake cec serio_raw
[ 87.926848] xen_acpi_processor xen_privcmd xen_pciback xen_blkback xen_gntalloc xen_gntdev xen_evtchn scsi_dh_rdac scsi_dh_emc scsi_dh_alua uinput i2c_dev
[ 87.926895] CPU: 9 UID: 0 PID: 518 Comm: kworker/u56:3 Tainted: G W 6.18.0-0.rc3.1.qubes.1.fc41.x86_64 #1 PREEMPT(full)
[ 87.926903] Tainted: [W]=WARN
[ 87.926906] Hardware name: Notebook V54x_6x_TU/V54x_6x_TU, BIOS Dasharo (coreboot+heads) v0.9.0 01/01/1970
[ 87.926912] Workqueue: async async_run_entry_fn
[ 87.926918] RIP: e030:__flush_work+0x340/0x390
[ 87.926923] Code: 26 9d 05 00 65 48 8b 15 26 3c ca 02 48 85 db 48 8b 04 24 48 89 54 24 58 0f 85 de fe ff ff e9 f6 fd ff ff 0f 0b e9 77 ff ff ff <0f> 0b e9 70 ff ff ff 0f 0b e9 19 ff ff ff e8 7d 8b 0e 01 48 89 de
[ 87.926931] RSP: e02b:ffffc900412ebc00 EFLAGS: 00010246
[ 87.926936] RAX: 0000000000000000 RBX: ffff888103e55090 RCX: 0000000000000000
[ 87.926941] RDX: 000fffffffe00000 RSI: 0000000000000001 RDI: ffffc900412ebc60
[ 87.926945] RBP: ffff888103e55090 R08: ffffffffc1266ec8 R09: ffff8881109076e8
[ 87.926949] R10: 0000000080040003 R11: 0000000000000000 R12: ffff888103e54000
[ 87.926953] R13: ffffc900412ebc18 R14: 0000000000000001 R15: 0000000000000000
[ 87.926962] FS: 0000000000000000(0000) GS:ffff888233238000(0000) knlGS:0000000000000000
[ 87.926967] CS: e030 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 87.926971] CR2: 00007e7923b32708 CR3: 00000001088df000 CR4: 0000000000050660
[ 87.926977] Call Trace:
[ 87.926981] <TASK>
[ 87.926987] ? __call_rcu_common.constprop.0+0x11e/0x310
[ 87.926993] cancel_work_sync+0x5e/0x80
[ 87.926999] mei_cancel_work+0x19/0x40 [mei]
[ 87.927051] mei_me_probe+0x273/0x2b0 [mei_me]
[ 87.927060] local_pci_probe+0x45/0x90
[ 87.927066] pci_call_probe+0x5b/0x180
[ 87.927070] pci_device_probe+0x95/0x140
[ 87.927074] ? driver_sysfs_add+0x57/0xc0
[ 87.927079] really_probe+0xde/0x340
[ 87.927083] ? pm_runtime_barrier+0x54/0x90
[ 87.927087] __driver_probe_device+0x78/0x110
[ 87.927092] driver_probe_device+0x1f/0xa0
[ 87.927095] __driver_attach_async_helper+0x5e/0xe0
[ 87.927100] async_run_entry_fn+0x34/0x130
[ 87.927104] process_one_work+0x18d/0x340
[ 87.927108] worker_thread+0x256/0x3a0
[ 87.927111] ? __pfx_worker_thread+0x10/0x10
[ 87.927115] kthread+0xfc/0x240
[ 87.927120] ? __pfx_kthread+0x10/0x10
[ 87.927124] ? __pfx_kthread+0x10/0x10
[ 87.927127] ret_from_fork+0xf5/0x110
[ 87.927132] ? __pfx_kthread+0x10/0x10
[ 87.927136] ret_from_fork_asm+0x1a/0x30
[ 87.927141] </TASK>
[ 87.927143] ---[ end trace 0000000000000000 ]---
...
[ 87.927717] BUG: kernel NULL pointer dereference, address: 0000000000000060
[ 87.927722] #PF: supervisor read access in kernel mode
[ 87.927726] #PF: error_code(0x0000) - not-present page
[ 87.927730] PGD 0 P4D 0
[ 87.927734] Oops: Oops: 0000 [#1] SMP NOPTI
[ 87.927739] CPU: 9 UID: 0 PID: 518 Comm: kworker/u56:3 Tainted: G W 6.18.0-0.rc3.1.qubes.1.fc41.x86_64 #1 PREEMPT(full)
[ 87.927746] Tainted: [W]=WARN
[ 87.927749] Hardware name: Notebook V54x_6x_TU/V54x_6x_TU, BIOS Dasharo (coreboot+heads) v0.9.0 01/01/1970
[ 87.927754] Workqueue: async async_run_entry_fn
[ 87.927759] RIP: e030:mei_me_probe+0x27e/0x2b0 [mei_me]
[ 87.927765] Code: 11 00 00 00 74 ac 4c 89 ef e8 8e 4f f4 bf eb a2 bb ed ff ff ff eb 9d 4c 89 e7 e8 8d fa 02 00 49 8b 84 24 18 11 00 00 4c 89 e7 <48> 8b 40 60 2e 2e 2e ff d0 8b bd c4 03 00 00 4c 89 e6 e8 eb 9f 41
[ 87.927774] RSP: e02b:ffffc900412ebcc8 EFLAGS: 00010296
[ 87.927778] RAX: 0000000000000000 RBX: 00000000ffffffed RCX: 000fffffffe00000
[ 87.927783] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff888103e54000
[ 87.927787] RBP: ffff888101e79000 R08: ffffffffc1266ec8 R09: ffff8881109076e8
[ 87.927792] R10: 0000000080040003 R11: 0000000000000000 R12: ffff888103e54000
[ 87.927796] R13: ffff888101e790c8 R14: ffff888112253d40 R15: 0000000000000000
[ 87.927805] FS: 0000000000000000(0000) GS:ffff888233238000(0000) knlGS:0000000000000000
[ 87.927810] CS: e030 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 87.927814] CR2: 0000000000000060 CR3: 00000001088df000 CR4: 0000000000050660
[ 87.927820] Call Trace:
[ 87.927823] <TASK>
[ 87.927826] local_pci_probe+0x45/0x90
[ 87.927831] pci_call_probe+0x5b/0x180
[ 87.927835] pci_device_probe+0x95/0x140
[ 87.927839] ? driver_sysfs_add+0x57/0xc0
[ 87.927843] really_probe+0xde/0x340
[ 87.927847] ? pm_runtime_barrier+0x54/0x90
[ 87.927852] __driver_probe_device+0x78/0x110
[ 87.927858] driver_probe_device+0x1f/0xa0
[ 87.927862] __driver_attach_async_helper+0x5e/0xe0
[ 87.927867] async_run_entry_fn+0x34/0x130
[ 87.927872] process_one_work+0x18d/0x340
[ 87.927876] worker_thread+0x256/0x3a0
[ 87.927880] ? __pfx_worker_thread+0x10/0x10
[ 87.927884] kthread+0xfc/0x240
[ 87.927889] ? __pfx_kthread+0x10/0x10
[ 87.927893] ? __pfx_kthread+0x10/0x10
[ 87.927897] ret_from_fork+0xf5/0x110
[ 87.927901] ? __pfx_kthread+0x10/0x10
[ 87.927906] ret_from_fork_asm+0x1a/0x30
[ 87.927910] </TASK>
[ 87.927913] Modules linked in: intel_rapl_msr intel_powerclamp i2c_i801 intel_rapl_common snd pcspkr spi_intel_pci rfkill e1000e spi_intel processor_thermal_wt_req i2c_smbus mei_me processor_thermal_power_floor soundcore mei processor_thermal_mbox idma64 intel_pmc_core int340x_thermal_zone igen6_edac pmt_telemetry pmt_discovery pmt_class intel_hid sparse_keymap intel_pmc_ssram_telemetry intel_scu_pltdrv joydev fuse loop xenfs nfnetlink vsock_loopback vmw_vsock_virtio_transport_common zram vmw_vsock_vmci_transport lz4hc_compress vsock vmw_vmci lz4_compress dm_thin_pool dm_persistent_data dm_bio_prison dm_crypt xe drm_ttm_helper drm_suballoc_helper gpu_sched drm_gpuvm drm_exec drm_gpusvm_helper nvme i915 nvme_core sdhci_pci sdhci_uhs2 i2c_algo_bit nvme_keyring drm_buddy sdhci intel_pmc_mux nvme_auth ttm cqhci typec xhci_pci hid_multitouch polyval_clmulni ghash_clmulni_intel mmc_core hkdf intel_vpu intel_vsec xhci_hcd drm_display_helper i2c_hid_acpi i2c_hid thunderbolt video wmi pinctrl_meteorlake cec serio_raw
[ 87.927957] xen_acpi_processor xen_privcmd xen_pciback xen_blkback xen_gntalloc xen_gntdev xen_evtchn scsi_dh_rdac scsi_dh_emc scsi_dh_alua uinput i2c_dev
[ 87.928002] CR2: 0000000000000060
[ 87.928006] ---[ end trace 0000000000000000 ]---
The ME initialization failure is expected - ME is either disabled via
firmware (the case above), or not directly visible at all (a VM). But
the panic ofc is not expected.
Full console log: https://openqa.qubes-os.org/tests/158203/logfile?filename=serial0.txt
Some more examples in this issue (but all look pretty similar):
https://github.com/QubesOS/qubes-issues/issues/10378
#regzbot introduced: v6.17.4..v6.18-rc3
--
Best Regards,
Marek Marczykowski-Górecki
Invisible Things Lab
Download attachment "signature.asc" of type "application/pgp-signature" (489 bytes)
Powered by blists - more mailing lists