Message-ID: <b22f80a3-7b1b-a8fc-d837-cfeb03b80b0d@datenfreihafen.org>
Date:   Sat, 4 May 2019 20:47:32 +0200
From:   Stefan Schmidt <stefan@...enfreihafen.org>
To:     Yue Haibing <yuehaibing@...wei.com>, alex.aring@...il.com,
        davem@...emloft.net
Cc:     linux-kernel@...r.kernel.org, netdev@...r.kernel.org,
        linux-wpan@...r.kernel.org
Subject: Re: [PATCH] ieee802154: hwsim: Fix error handle path in
 hwsim_init_module

Hello.

On 28.04.19 16:14, Yue Haibing wrote:
> From: YueHaibing <yuehaibing@...wei.com>
> 
> KASAN report this:
> 
> BUG: unable to handle kernel paging request at fffffbfff834f001
> PGD 237fe8067 P4D 237fe8067 PUD 237e64067 PMD 1c968d067 PTE 0
> Oops: 0000 [#1] SMP KASAN PTI
> CPU: 1 PID: 8871 Comm: syz-executor.0 Tainted: G         C        5.0.0+ #5
> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1 04/01/2014
> RIP: 0010:strcmp+0x31/0xa0 lib/string.c:328
> Code: 00 00 00 00 fc ff df 55 53 48 83 ec 08 eb 0a 84 db 48 89 ef 74 5a 4c 89 e6 48 89 f8 48 89 fa 48 8d 6f 01 48 c1 e8 03 83 e2 07 <42> 0f b6 04 28 38 d0 7f 04 84 c0 75 50 48 89 f0 48 89 f2 0f b6 5d
> RSP: 0018:ffff8881e0c57800 EFLAGS: 00010246
> RAX: 1ffffffff834f001 RBX: ffffffffc1a78000 RCX: ffffffff827b9503
> RDX: 0000000000000000 RSI: ffffffffc1a40008 RDI: ffffffffc1a78008
> RBP: ffffffffc1a78009 R08: fffffbfff6a92195 R09: fffffbfff6a92195
> R10: ffff8881e0c578b8 R11: fffffbfff6a92194 R12: ffffffffc1a40008
> R13: dffffc0000000000 R14: ffffffffc1a3e470 R15: ffffffffc1a40000
> FS:  00007fdcc02ff700(0000) GS:ffff8881f7300000(0000) knlGS:0000000000000000
> CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: fffffbfff834f001 CR3: 00000001b3134003 CR4: 00000000007606e0
> DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
> DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
> PKRU: 55555554
> Call Trace:
>  genl_family_find_byname+0x7f/0xf0 net/netlink/genetlink.c:104
>  genl_register_family+0x1e1/0x1070 net/netlink/genetlink.c:333
>  ? 0xffffffffc1978000
>  hwsim_init_module+0x6a/0x1000 [mac802154_hwsim]
>  ? 0xffffffffc1978000
>  ? 0xffffffffc1978000
>  ? 0xffffffffc1978000
>  do_one_initcall+0xbc/0x47d init/main.c:887
>  do_init_module+0x1b5/0x547 kernel/module.c:3456
>  load_module+0x6405/0x8c10 kernel/module.c:3804
>  __do_sys_finit_module+0x162/0x190 kernel/module.c:3898
>  do_syscall_64+0x9f/0x450 arch/x86/entry/common.c:290
>  entry_SYSCALL_64_after_hwframe+0x49/0xbe
> RIP: 0033:0x462e99
> Code: f7 d8 64 89 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
> RSP: 002b:00007fdcc02fec58 EFLAGS: 00000246 ORIG_RAX: 0000000000000139
> RAX: ffffffffffffffda RBX: 000000000073bf00 RCX: 0000000000462e99
> RDX: 0000000000000000 RSI: 0000000020000200 RDI: 0000000000000003
> RBP: 00007fdcc02fec70 R08: 0000000000000000 R09: 0000000000000000
> R10: 0000000000000000 R11: 0000000000000246 R12: 00007fdcc02ff6bc
> R13: 00000000004bcefa R14: 00000000006f6fb0 R15: 0000000000000004
> Modules linked in: mac802154_hwsim(+) mac802154 ieee802154 speakup(C) rc_proteus_2309 rtc_rk808 streebog_generic rds vboxguest madera_spi madera da9052_wdt mISDN_core ueagle_atm usbatm atm ir_imon_decoder scsi_transport_sas rc_dntv_live_dvb_t panel_samsung_s6d16d0 drm drm_panel_orientation_quirks lib80211 fb_agm1264k_fl(C) gspca_pac7302 gspca_main videobuf2_v4l2 soundwire_intel_init i2c_dln2 dln2 usbcore hid_gaff 88pm8607 nfnetlink axp20x_i2c axp20x uio pata_marvell pmbus_core snd_sonicvibes gameport snd_pcm snd_opl3_lib snd_timer snd_hwdep snd_mpu401_uart snd_rawmidi snd_seq_device snd soundcore rtc_ds1511 rtc_ds1742 vsock dwc_xlgmac rtc_rx8010 libphy twofish_x86_64_3way twofish_x86_64 twofish_common ad5696_i2c ad5686 lp8788_charger cxd2880_spi dvb_core videobuf2_common videodev media videobuf2_vmalloc videobuf2_memops fbtft(C) sysimgblt sysfillrect syscopyarea fb_sys_fops janz_ican3 firewire_net firewire_core crc_itu_t spi_slave_system_control i2c_matroxfb i2c_algo_bit
>  matroxfb_base fb fbdev matroxfb_DAC1064 matroxfb_accel cfbcopyarea cfbimgblt cfbfillrect matroxfb_Ti3026 matroxfb_g450 g450_pll matroxfb_misc leds_blinkm ti_dac7311 intel_spi_pci intel_spi spi_nor hid_elan hid async_tx rc_cinergy_1400 rc_core intel_ishtp kxcjk_1013 industrialio_triggered_buffer kfifo_buf can_dev intel_th spi_pxa2xx_platform pata_artop vme_ca91cx42 gb_gbphy(C) greybus(C) industrialio mptbase st_drv cmac ttpci_eeprom via_wdt gpio_xra1403 mtd iptable_security iptable_raw iptable_mangle iptable_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 iptable_filter bpfilter ip6_vti ip_vti ip_gre ipip sit tunnel4 ip_tunnel hsr veth netdevsim vxcan batman_adv cfg80211 rfkill chnl_net caif nlmon dummy team bonding vcan bridge stp llc ip6_gre gre ip6_tunnel tunnel6 tun joydev mousedev ppdev kvm_intel kvm irqbypass crct10dif_pclmul crc32_pclmul crc32c_intel ghash_clmulni_intel aesni_intel aes_x86_64 input_leds crypto_simd cryptd glue_helper ide_pci_generic piix psmouse
>  ide_core serio_raw ata_generic i2c_piix4 pata_acpi parport_pc parport floppy rtc_cmos intel_agp intel_gtt agpgart sch_fq_codel ip_tables x_tables sha1_ssse3 sha1_generic ipv6 [last unloaded: speakup]
> Dumping ftrace buffer:
>    (ftrace buffer empty)
> CR2: fffffbfff834f001
> ---[ end trace 5aa772c793e0e971 ]---
> RIP: 0010:strcmp+0x31/0xa0 lib/string.c:328
> Code: 00 00 00 00 fc ff df 55 53 48 83 ec 08 eb 0a 84 db 48 89 ef 74 5a 4c 89 e6 48 89 f8 48 89 fa 48 8d 6f 01 48 c1 e8 03 83 e2 07 <42> 0f b6 04 28 38 d0 7f 04 84 c0 75 50 48 89 f0 48 89 f2 0f b6 5d
> RSP: 0018:ffff8881e0c57800 EFLAGS: 00010246
> RAX: 1ffffffff834f001 RBX: ffffffffc1a78000 RCX: ffffffff827b9503
> RDX: 0000000000000000 RSI: ffffffffc1a40008 RDI: ffffffffc1a78008
> RBP: ffffffffc1a78009 R08: fffffbfff6a92195 R09: fffffbfff6a92195
> R10: ffff8881e0c578b8 R11: fffffbfff6a92194 R12: ffffffffc1a40008
> R13: dffffc0000000000 R14: ffffffffc1a3e470 R15: ffffffffc1a40000
> FS:  00007fdcc02ff700(0000) GS:ffff8881f7300000(0000) knlGS:0000000000000000
> CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: fffffbfff834f001 CR3: 00000001b3134003 CR4: 00000000007606e0
> DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
> DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
> PKRU: 55555554
> 
> The error handing path misplace the cleanup in hwsim_init_module,
> switch the two cleanup functions to fix above issues.
> 
> Reported-by: Hulk Robot <hulkci@...wei.com>
> Fixes: f25da51fdc38 ("ieee802154: hwsim: add replacement for fakelb")
> Signed-off-by: YueHaibing <yuehaibing@...wei.com>
> ---
>  drivers/net/ieee802154/mac802154_hwsim.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/net/ieee802154/mac802154_hwsim.c b/drivers/net/ieee802154/mac802154_hwsim.c
> index 3b88846..c2b6ffb 100644
> --- a/drivers/net/ieee802154/mac802154_hwsim.c
> +++ b/drivers/net/ieee802154/mac802154_hwsim.c
> @@ -912,9 +912,9 @@ static __init int hwsim_init_module(void)
>  	return 0;
>  
>  platform_drv:
> -	genl_unregister_family(&hwsim_genl_family);
> -platform_dev:
>  	platform_device_unregister(mac802154hwsim_dev);
> +platform_dev:
> +	genl_unregister_family(&hwsim_genl_family);
>  	return rc;
>  }
>  
> 


This patch has been applied to the wpan tree and will be
part of the next pull request to net. Thanks!

regards
Stefan Schmidt

Powered by blists - more mailing lists