Messages in this thread | | | Date | Thu, 16 Jun 2022 23:18:33 +0000 | From | William McVicker <> | Subject | Re: [PATCH v1] sysfs: fix sysfs_kf_seq_show null pointer dereference |
| |
On 06/15/2022, Christoph Hellwig wrote: > On Tue, Jun 14, 2022 at 07:28:31PM +0200, Greg Kroah-Hartman wrote: > > On Tue, Jun 14, 2022 at 05:24:01PM +0000, Will McVicker wrote: > > > When the kobj->ktype is null, > > > > How can that happen? What in-tree code does that? > > Yes, I'd be really curious how we arrived there. I we ever end in > this case we're having a major problem, as all the sysfs files > should go through sysfs_add_file_mode_ns, which already derferences > kobj->ktype->sysfs_ops directly. I.e. for this to happen > kobj->ktype must have been cleared on a live file, or someone > must have bypassed sysfs_add_file_mode_ns.
Okay, so I was able to figure out that the Android userspace process that triggers this issue is called rebalance_interrupts. You can find the source code here [1]. I can reproduce this issue in about 5-10 reboots. As the name indicates, it rebalances the IRQs. I found that the crash happens when the program reads the sysfs files: /sys/kernel/irq/<irq>/actions. I haven't looked into how kobj->ktype becomes null yet. I'll look deeper into that now, but wanted to update this thread in case this information triggers any hints for you guys on why this is happening.
Thanks, Will
[1] https://android.googlesource.com/platform/hardware/google/pixel/+/refs/heads/android12-qpr3-s2-release/rebalance_interrupts
| |