| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Thu, 8 Jun 2023 10:33:30 -0700
From: Florian Fainelli <f.fainelli@...il.com>
To: Andrew Lunn <andrew@...n.ch>
Cc: "netdev@...r.kernel.org" <netdev@...r.kernel.org>,
Heiner Kallweit <hkallweit1@...il.com>,
Christian Marangi <ansuelsmth@...il.com>, Vladimir Oltean
<olteanv@...il.com>, Pavel Machek <pavel@....cz>, Lee Jones
<lee@...nel.org>, "linux-leds@...r.kernel.org" <linux-leds@...r.kernel.org>
Subject: Re: NPD in phy_led_set_brightness+0x3c
On 6/7/23 18:30, Andrew Lunn wrote:
>> (gdb) print /x (int)&((struct phy_driver *)0)->led_brightness_set
>> $1 = 0x1f0
>>
>> so this would indeed look like an use-after-free here. If you tested with a
>> PHYLINK enabled driver you might have no seen due to
>> phylink_disconnect_phy() being called with RTNL held?
>
> Yes, i've been testing with mvneta, which is phylink.
Humm, this is really puzzling because we have the below call trace as to
where we call schedule_work() which is in led_set_brightness_nopm()
however we have led_classdev_unregister() call flush_work() to ensure
the workqueue completed. Is there something else in that call stack that
prevents the system workqueue from running?
[ 280.663384] ------------[ cut here ]------------
[ 280.668038] WARNING: CPU: 3 PID: 1497 at drivers/leds/led-core.c:333
led_set_brightness_nopm+0x68/0xf8
[ 280.677378] Modules linked in: bdc udc_core
[ 280.681585] CPU: 3 PID: 1497 Comm: reboot Not tainted
6.4.0-rc5-next-20230607-g27d73db94b91 #94
[ 280.690304] Hardware name: BCM972180HB_V20 (DT)
[ 280.694845] pstate: 20000005 (nzCv daif -PAN -UAO -TCO -DIT -SSBS
BTYPE=--)
[ 280.701824] pc : led_set_brightness_nopm+0x68/0xf8
[ 280.706628] lr : led_set_brightness_nosleep+0x2c/0x38
[ 280.711691] sp : ffffffc082ddb7b0
[ 280.715012] x29: ffffffc082ddb7b0 x28: ffffff8007a55780 x27:
0000000000000000
[ 280.722168] x26: ffffff8002fdcc90 x25: 0000000000000001 x24:
0000000000000000
[ 280.729323] x23: ffffff8002e6b000 x22: ffffffc082ddb898 x21:
ffffffc080c4b676
[ 280.736480] x20: ffffff800792b990 x19: ffffff800792b898 x18:
0000000000000000
[ 280.743636] x17: 74656e2f74656e72 x16: 656874652e303030 x15:
303066382f626472
[ 280.750791] x14: ffffff8004a6ccd8 x13: 6e69622f7273752f x12:
0000000000000000
[ 280.757948] x11: ffffff8002d1c710 x10: ffffff8002e6b2a0 x9 :
ffffffc0807ad6c0
[ 280.765103] x8 : ffffffc080595964 x7 : ffffffc08059550c x6 :
ffffff8002e6b2a0
[ 280.772258] x5 : 0000000000000000 x4 : ffffff800792b8b0 x3 :
ffffff800792b8b0
[ 280.779414] x2 : ffffff800792b898 x1 : 0000000000000000 x0 :
0000000000000040
[ 280.786570] Call trace:
[ 280.789021] led_set_brightness_nopm+0x68/0xf8
[ 280.793476] led_set_brightness_nosleep+0x2c/0x38
[ 280.798192] led_set_brightness+0x9c/0xa0
[ 280.802210] led_classdev_unregister+0x78/0xd0
[ 280.806665] devm_led_classdev_release+0x18/0x20
[ 280.811294] release_nodes+0x70/0x84
[ 280.814884] devres_release_all+0xa0/0xd4
[ 280.818905] device_unbind_cleanup+0x1c/0x60
[ 280.823189] device_release_driver_internal+0xa8/0x128
[ 280.828341] device_release_driver+0x1c/0x24
[ 280.832622] bus_remove_device+0x108/0x12c
[ 280.836731] device_del+0x194/0x2ec
[ 280.840230] phy_device_remove+0x1c/0x3c
[ 280.844167] phy_mdio_device_remove+0x14/0x1c
[ 280.848537] mdiobus_unregister+0x6c/0xa0
[ 280.852560] unimac_mdio_remove+0x20/0x4c
[ 280.856582] platform_remove+0x50/0x68
[ 280.860342] device_remove+0x50/0x74
[ 280.863929] device_release_driver_internal+0x80/0x128
[ 280.869079] device_release_driver+0x1c/0x24
[ 280.873360] bus_remove_device+0x108/0x12c
[ 280.877471] device_del+0x194/0x2ec
[ 280.880969] platform_device_del+0x2c/0x90
[ 280.885077] platform_device_unregister+0x1c/0x30
[ 280.889793] bcmgenet_mii_exit+0x40/0x4c
[ 280.893728] bcmgenet_remove+0x2c/0x44
[ 280.897489] bcmgenet_shutdown+0x14/0x1c
[ 280.901422] platform_shutdown+0x28/0x34
[ 280.905355] device_shutdown+0x158/0x1d8
[ 280.909290] kernel_restart_prepare+0x3c/0x44
[ 280.913661] kernel_restart+0x1c/0x7c
[ 280.917332] __do_sys_reboot+0x170/0x1f4
[ 280.921265] __arm64_sys_reboot+0x24/0x2c
[ 280.925286] invoke_syscall+0x80/0x114
[ 280.929047] el0_svc_common.constprop.1+0xb8/0xe4
[ 280.933762] do_el0_svc+0x90/0x9c
[ 280.937086] el0_svc+0x1c/0x44
[ 280.940154] el0t_64_sync_handler+0x100/0x150
[ 280.944524] el0t_64_sync+0x14c/0x150
[ 280.948198] ---[ end trace 0000000000000000 ]---
[ 280.952885] Unable to handle kernel NULL pointer dereference at
virtual address 00000000000001f0
[ 280.961697] Mem abort info:
[ 280.964502] ESR = 0x0000000096000005
[ 280.968264] EC = 0x25: DABT (current EL), IL = 32 bits
[ 280.973594] SET = 0, FnV = 0
[ 280.976661] EA = 0, S1PTW = 0
[ 280.979815] FSC = 0x05: level 1 translation fault
[ 280.984708] Data abort info:
[ 280.987600] ISV = 0, ISS = 0x00000005, ISS2 = 0x00000000
[ 280.993101] CM = 0, WnR = 0, TnD = 0, TagAccess = 0
[ 280.998170] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
[ 281.003500] user pgtable: 4k pages, 39-bit VAs, pgdp=0000000045cde000
[ 281.009960] [00000000000001f0] pgd=0000000000000000,
p4d=0000000000000000, pud=0000000000000000
[ 281.018691] Internal error: Oops: 0000000096000005 [#1] SMP
[ 281.024280] Modules linked in: bdc udc_core
[ 281.028480] CPU: 3 PID: 817 Comm: kworker/3:2 Tainted: G W
6.4.0-rc5-next-20230607-g27d73db94b91 #94
[ 281.039024] Hardware name: BCM972180HB_V20 (DT)
[ 281.043565] Workqueue: events set_brightness_delayed
[ 281.048543] pstate: 40000005 (nZcv daif -PAN -UAO -TCO -DIT -SSBS
BTYPE=--)
[ 281.055520] pc : phy_led_set_brightness+0x3c/0x68
[ 281.060238] lr : phy_led_set_brightness+0x30/0x68
[ 281.064955] sp : ffffffc0845bbd20
[ 281.068276] x29: ffffffc0845bbd20 x28: 0000000000000000 x27:
0000000000000000
[ 281.075432] x26: 0000000000000000 x25: 0000000000000000 x24:
ffffff807dbcc40d
[ 281.082587] x23: ffffff800792b960 x22: 0000000000000000 x21:
ffffff800792b880
[ 281.089743] x20: ffffff8002e6b520 x19: ffffff8002e6b000 x18:
0000000000000000
[ 281.096899] x17: 74656e2f74656e72 x16: 656874652e303030 x15:
303066382f626472
[ 281.104054] x14: ffffff8004a6ccd8 x13: 6e69622f7273752f x12:
0000000000000000
[ 281.111209] x11: ffffff8002d1c710 x10: 0000000000000870 x9 :
ffffffc080663bd0
[ 281.118364] x8 : ffffff80065f1a80 x7 : fefefefefefefeff x6 :
000073746e657665
[ 281.125519] x5 : ffffff80065f1a80 x4 : 0000000000000000 x3 :
0000000000000000
[ 281.132676] x2 : 0000000000000000 x1 : 0000000000000001 x0 :
0000000000000000
[ 281.139831] Call trace:
[ 281.142283] phy_led_set_brightness+0x3c/0x68
[ 281.146652] set_brightness_delayed_set_brightness+0x44/0x7c
[ 281.152328] set_brightness_delayed+0xc4/0x1a4
[ 281.156783] process_one_work+0x1c0/0x284
[ 281.160806] process_scheduled_works+0x44/0x48
[ 281.165263] worker_thread+0x1e8/0x264
[ 281.169023] kthread+0xcc/0xdc
[ 281.172089] ret_from_fork+0x10/0x20
[ 281.175678] Code: 940edf9f f941a660 2a1603e2 3946c2a1 (f940f803)
[ 281.181786] ---[ end trace 0000000000000000 ]---
--
Florian
Powered by blists - more mailing lists