lkml.org 
[lkml]   [2023]   [Feb]   [20]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    From
    Date
    Subjectarm64: libgpiod: refcount_t: underflow; use-after-free.
    Following kernel warning notices on qemu-arm64, qemu-arm and also on devices
    running Linux version v6.2.0 while running libgpiod tests.

    + ./gpiod.sh /opt/libgpiod/bin/
    [INFO] libgpiod test suite
    [INFO] 117 tests registered
    [INFO] checking the linux kernel version
    [INFO] kernel release is v6.2.0 - ok to run tests
    [INFO] using gpio-tools from '/usr/bin'
    [ 10.499036] ------------[ cut here ]------------
    [ 10.499656] refcount_t: underflow; use-after-free.
    [ 10.500264] WARNING: CPU: 2 PID: 291 at lib/refcount.c:28
    refcount_warn_saturate+0xf4/0x144
    [ 10.501306] Modules linked in: gpio_mockup(-) cfg80211 bluetooth
    rfkill crct10dif_ce fuse drm
    [ 10.502364] CPU: 2 PID: 291 Comm: gpiod-test Not tainted 6.2.0 #1
    [ 10.503229] Hardware name: linux,dummy-virt (DT)
    [ 10.503883] pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
    [ 10.505331] pc : refcount_warn_saturate+0xf4/0x144
    [ 10.505723] lr : refcount_warn_saturate+0xf4/0x144
    [ 10.506115] sp : ffff800008983cd0
    [ 10.506391] x29: ffff800008983cd0 x28: ffff0000c4c4c100 x27: 0000000000000000
    [ 10.506961] x26: 0000000000000000 x25: 0000000000000000 x24: 0000000000000000
    [ 10.507533] x23: 0000000000000200 x22: ffff0000c4e66800 x21: ffff0000c7734640
    [ 10.508104] x20: 0000000000000001 x19: ffff0000c7734600 x18: ffffffffffffffff
    [ 10.508677] x17: 3d4d455453595342 x16: ffffcf0234432020 x15: ffff800088983957
    [ 10.509424] x14: 0000000000000000 x13: 2e656572662d7265 x12: 7466612d65737520
    [ 10.510003] x11: 3b776f6c66726564 x10: ffffcf02365db580 x9 : ffffcf0233b20138
    [ 10.510575] x8 : 00000000ffffefff x7 : ffffcf02365db580 x6 : 0000000000000001
    [ 10.511145] x5 : ffffcf023655f000 x4 : ffffcf023655f2e8 x3 : 0000000000000000
    [ 10.511721] x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff0000c4c4c100
    [ 10.512294] Call trace:
    [ 10.512494] refcount_warn_saturate+0xf4/0x144
    [ 10.512971] kobject_put+0x164/0x220
    [ 10.513224] fwnode_remove_software_node+0x44/0x60
    [ 10.513554] gpio_mockup_unregister_pdevs+0x54/0x70 [gpio_mockup]
    [ 10.513970] gpio_mockup_exit+0x10/0x328 [gpio_mockup]
    [ 10.514322] __arm64_sys_delete_module+0x190/0x2a0
    [ 10.514653] invoke_syscall+0x50/0x120
    [ 10.514915] el0_svc_common.constprop.0+0x104/0x124
    [ 10.515277] do_el0_svc+0x44/0xcc
    [ 10.515541] el0_svc+0x30/0x94
    [ 10.515788] el0t_64_sync_handler+0xbc/0x13c
    [ 10.516126] el0t_64_sync+0x190/0x194
    [ 10.516419] ---[ end trace 0000000000000000 ]---


    Build and test logs,
    https://qa-reports.linaro.org/lkft/linux-mainline-master/build/v6.2/testrun/14856342/suite/libgpiod/test/ctxless-get-value-single-line/log
    https://qa-reports.linaro.org/lkft/linux-mainline-master/build/v6.2/testrun/14856342/suite/libgpiod/tests/


    --
    Linaro LKFT
    https://lkft.linaro.org

    \
     
     \ /
      Last update: 2023-03-27 00:29    [W:3.363 / U:1.128 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site