| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <CANypQFYAX-yhs=OZSePo=m2zH4wnOR6qnw0msq13M0TqnPEmGw@mail.gmail.com> Date: Fri, 16 Jan 2026 17:35:24 +0800 From: Jiaming Zhang <r772577952@...il.com> To: linux-kernel@...r.kernel.org Cc: verkuil+cisco@...nel.org, linux-media@...r.kernel.org, mchehab@...nel.org, ribalda@...omium.org, sakari.ailus@...ux.intel.com, syzkaller@...glegroups.com Subject: [Linux Kernel Bug] general protection fault in dvb_device_open Dear Linux kernel developers and maintainers, We are writing to report a general protection fault discovered in the dvb subsystem. Unfortunately, we do not currently have a reproducer for this issue. Based on our analysis, we suspect this is caused by a race condition. It appears that dvbdev is freed, but the corresponding entry in dvb_minors is not cleared or updated in time. Consequently, the kernel attempts to access this freed memory, resulting in a system crash. (https://elixir.bootlin.com/linux/v6.19-rc4/source/drivers/media/dvb-core/dvbdev.c#L97-L103) We have attached the kernel console output and the kernel config to assist with the analysis. The issue report, symbolized by syz-symbolize, is listed below: --- Oops: general protection fault, probably for non-canonical address 0xfbd5a5d5a0000000: 0000 [#1] SMP KASAN NOPTI KASAN: maybe wild-memory-access in range [0xdead4ead00000000-0xdead4ead00000007] CPU: 1 UID: 0 PID: 52451 Comm: syz.8.4023 Tainted: G L 6.19.0-rc4-00020-gf0b9d8eb98df #1 PREEMPT(full) Tainted: [L]=SOFTLOCKUP Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 RIP: 0010:dvb_device_open+0xd8/0x350 drivers/media/dvb-core/dvbdev.c:103 Code: 18 4c 89 e0 48 c1 e8 03 80 3c 18 00 74 08 4c 89 e7 e8 bc 39 7e fa 4d 8b 2c 24 4d 85 ed 0f 84 45 01 00 00 4c 89 e8 48 c1 e8 03 <80> 3c 18 00 74 08 4c 89 ef e8 9a 39 7e fa 49 8b 7d 00 e8 01 3a 02 RSP: 0018:ffffc90002ed7790 EFLAGS: 00010216 RAX: 1bd5a9d5a0000000 RBX: dffffc0000000000 RCX: 0000000000000000 RDX: 0000000000000001 RSI: 0000000000000008 RDI: 00000000ffffffff RBP: ffff888000d31340 R08: ffffffff8ee11d8f R09: 1ffffffff1dc23b1 R10: dffffc0000000000 R11: fffffbfff1dc23b2 R12: ffff888022eff818 R13: dead4ead00000000 R14: ffff8880205bef78 R15: ffff888022eff800 FS: 00007f895f3b9640(0000) GS:ffff8880ec62c000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f895e7f29f0 CR3: 000000005d0a1000 CR4: 0000000000750ef0 PKRU: 80000000 Call Trace: <TASK> chrdev_open+0x4cc/0x5e0 fs/char_dev.c:414 do_dentry_open+0x7b1/0x1410 fs/open.c:962 vfs_open+0x3b/0x340 fs/open.c:1094 do_open fs/namei.c:4628 [inline] path_openat+0x3413/0x3dd0 fs/namei.c:4787 do_filp_open+0x1fa/0x410 fs/namei.c:4814 do_sys_openat2+0x121/0x230 fs/open.c:1430 do_sys_open fs/open.c:1436 [inline] __do_sys_openat fs/open.c:1452 [inline] __se_sys_openat fs/open.c:1447 [inline] __x64_sys_openat+0x138/0x170 fs/open.c:1447 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xe8/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f895e5b2d94 Code: 24 20 eb 8f 66 90 44 89 54 24 0c e8 e6 0f 03 00 44 8b 54 24 0c 44 89 e2 48 89 ee 41 89 c0 bf 9c ff ff ff b8 01 01 00 00 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 89 44 24 0c e8 28 10 03 00 8b 44 RSP: 002b:00007f895f3b8ac0 EFLAGS: 00000293 ORIG_RAX: 0000000000000101 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f895e5b2d94 RDX: 00000000001a1200 RSI: 00007f895f3b8b60 RDI: 00000000ffffff9c RBP: 00007f895f3b8b60 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000293 R12: 00000000001a1200 R13: 00007f895e846038 R14: 00007f895e845fa0 R15: 00007f895f399000 </TASK> Modules linked in: ---[ end trace 0000000000000000 ]--- RIP: 0010:dvb_device_open+0xd8/0x350 drivers/media/dvb-core/dvbdev.c:103 Code: 18 4c 89 e0 48 c1 e8 03 80 3c 18 00 74 08 4c 89 e7 e8 bc 39 7e fa 4d 8b 2c 24 4d 85 ed 0f 84 45 01 00 00 4c 89 e8 48 c1 e8 03 <80> 3c 18 00 74 08 4c 89 ef e8 9a 39 7e fa 49 8b 7d 00 e8 01 3a 02 RSP: 0018:ffffc90002ed7790 EFLAGS: 00010216 RAX: 1bd5a9d5a0000000 RBX: dffffc0000000000 RCX: 0000000000000000 RDX: 0000000000000001 RSI: 0000000000000008 RDI: 00000000ffffffff RBP: ffff888000d31340 R08: ffffffff8ee11d8f R09: 1ffffffff1dc23b1 R10: dffffc0000000000 R11: fffffbfff1dc23b2 R12: ffff888022eff818 R13: dead4ead00000000 R14: ffff8880205bef78 R15: ffff888022eff800 FS: 00007f895f3b9640(0000) GS:ffff88809902c000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f895e7e15b0 CR3: 000000005d0a1000 CR4: 0000000000750ef0 PKRU: 80000000 ---------------- Code disassembly (best guess): 0: 18 4c 89 e0 sbb %cl,-0x20(%rcx,%rcx,4) 4: 48 c1 e8 03 shr $0x3,%rax 8: 80 3c 18 00 cmpb $0x0,(%rax,%rbx,1) c: 74 08 je 0x16 e: 4c 89 e7 mov %r12,%rdi 11: e8 bc 39 7e fa call 0xfa7e39d2 16: 4d 8b 2c 24 mov (%r12),%r13 1a: 4d 85 ed test %r13,%r13 1d: 0f 84 45 01 00 00 je 0x168 23: 4c 89 e8 mov %r13,%rax 26: 48 c1 e8 03 shr $0x3,%rax * 2a: 80 3c 18 00 cmpb $0x0,(%rax,%rbx,1) <-- trapping instruction 2e: 74 08 je 0x38 30: 4c 89 ef mov %r13,%rdi 33: e8 9a 39 7e fa call 0xfa7e39d2 38: 49 8b 7d 00 mov 0x0(%r13),%rdi 3c: e8 .byte 0xe8 3d: 01 3a add %edi,(%rdx) 3f: 02 .byte 0x2 --- Please let me know if any further information is required. Best Regards, Jiaming Zhang Download attachment ".config" of type "application/xml" (278650 bytes) Download attachment "report" of type "application/octet-stream" (4432 bytes) Download attachment "kernel.log" of type "application/octet-stream" (136875 bytes)
Powered by blists - more mailing lists