syzbot


WARNING in nci_send_cmd

Status: fixed on 2023/02/24 13:50
Subsystems: net nfc
[Documentation on labels]
Reported-by: syzbot+43475bf3cfbd6e41f5b7@syzkaller.appspotmail.com
Fix commit: 0ad6bded175e nfc/nci: fix race with opening and closing
First crash: 519d, last: 505d
Duplicate bugs (3)
duplicates (3):
Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
BUG: unable to handle kernel NULL pointer dereference in nci_send_cmd net nfc C done 184 422d 518d 0/26 closed as dup on 2022/11/30 09:30
BUG: unable to handle kernel NULL pointer dereference in nci_cmd_timer nfc net C 122 442d 518d 0/26 closed as dup on 2022/11/30 09:28
KASAN: use-after-free Read in rfkill_blocked wireless 15 423d 511d 0/26 closed as dup on 2022/11/30 09:32
Discussions (3)
Title Replies (including bot) Last reply
[PATCH v2] nfc/nci: fix race with opening and closing 2 (2) 2022/11/18 12:40
[syzbot] WARNING in nci_send_cmd 1 (3) 2022/11/16 17:36
[PATCH v1] nfc/nci: fix race with opening and closing 1 (1) 2022/11/16 13:01
Last patch testing requests (2)
Created Duration User Patch Repo Result
2022/11/16 13:09 15m linma@zju.edu.cn https://github.com/f0rm2l1n/linux-fix.git master OK log
2022/11/16 12:10 15m hdanton@sina.com patch https://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git 9500fc6e9e60 OK log

Sample crash report:
------------[ cut here ]------------
WARNING: CPU: 1 PID: 3080 at kernel/workqueue.c:1438 is_chained_work kernel/workqueue.c:1382 [inline]
WARNING: CPU: 1 PID: 3080 at kernel/workqueue.c:1438 __queue_work+0x878/0x8b4 kernel/workqueue.c:1438
Modules linked in:
CPU: 1 PID: 3080 Comm: syz-executor415 Not tainted 6.1.0-rc6-syzkaller-32662-g6d464646530f #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/30/2022
pstate: 804000c5 (Nzcv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : __queue_work+0x878/0x8b4 kernel/workqueue.c:1382
lr : is_chained_work kernel/workqueue.c:1382 [inline]
lr : __queue_work+0x878/0x8b4 kernel/workqueue.c:1438
sp : ffff80000ff93710
x29: ffff80000ff93710 x28: ffff0000c78cb480 x27: 0000000000000000
x26: ffff0000c7afb810 x25: ffff0000c78cb480 x24: 0000000000000100
x23: 0000000100000000 x22: 00000000000f000a x21: ffff0000c780b400
x20: 0000000000000008 x19: ffff0000c7d770f8 x18: 00000000000000f7
x17: ffff80000c0cd83c x16: ffff80000dbe6158 x15: ffff0000c78cb480
x14: 00000000000000c0 x13: 00000000ffffffff x12: ffff0000c78cb480
x11: ff80800008130ebc x10: 0000000000000000 x9 : ffff800008130ebc
x8 : ffff0000c78cb480 x7 : ffff80000b2350cc x6 : 0000000000000000
x5 : 0000000000000080 x4 : 0000000000000001 x3 : 0000000000000000
x2 : ffff0000c7d770f8 x1 : 0000000000000000 x0 : 0000000000000000
Call trace:
 is_chained_work kernel/workqueue.c:1382 [inline]
 __queue_work+0x878/0x8b4 kernel/workqueue.c:1438
 queue_work_on+0xb0/0x15c kernel/workqueue.c:1545
 queue_work include/linux/workqueue.h:503 [inline]
 nci_send_cmd+0xe8/0x154 net/nfc/nci/core.c:1376
 nci_reset_req net/nfc/nci/core.c:166 [inline]
 __nci_request net/nfc/nci/core.c:107 [inline]
 nci_open_device+0x168/0x518 net/nfc/nci/core.c:502
 nci_dev_up+0x20/0x30 net/nfc/nci/core.c:631
 nfc_dev_up+0xcc/0x1b0 net/nfc/core.c:118
 nfc_genl_dev_up+0x40/0x78 net/nfc/netlink.c:770
 genl_family_rcv_msg_doit net/netlink/genetlink.c:756 [inline]
 genl_family_rcv_msg net/netlink/genetlink.c:833 [inline]
 genl_rcv_msg+0x458/0x4f4 net/netlink/genetlink.c:850
 netlink_rcv_skb+0xe8/0x1d4 net/netlink/af_netlink.c:2540
 genl_rcv+0x38/0x50 net/netlink/genetlink.c:861
 netlink_unicast_kernel+0xfc/0x1dc net/netlink/af_netlink.c:1319
 netlink_unicast+0x164/0x248 net/netlink/af_netlink.c:1345
 netlink_sendmsg+0x484/0x584 net/netlink/af_netlink.c:1921
 sock_sendmsg_nosec net/socket.c:714 [inline]
 sock_sendmsg net/socket.c:734 [inline]
 ____sys_sendmsg+0x2f8/0x440 net/socket.c:2482
 ___sys_sendmsg net/socket.c:2536 [inline]
 __sys_sendmsg+0x1ac/0x228 net/socket.c:2565
 __do_sys_sendmsg net/socket.c:2574 [inline]
 __se_sys_sendmsg net/socket.c:2572 [inline]
 __arm64_sys_sendmsg+0x2c/0x3c net/socket.c:2572
 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
 invoke_syscall arch/arm64/kernel/syscall.c:52 [inline]
 el0_svc_common+0x138/0x220 arch/arm64/kernel/syscall.c:142
 do_el0_svc+0x48/0x164 arch/arm64/kernel/syscall.c:206
 el0_svc+0x58/0x150 arch/arm64/kernel/entry-common.c:637
 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
 el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:584
irq event stamp: 56
hardirqs last  enabled at (55): [<ffff80000c090584>] __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:151 [inline]
hardirqs last  enabled at (55): [<ffff80000c090584>] _raw_spin_unlock_irqrestore+0x48/0x8c kernel/locking/spinlock.c:194
hardirqs last disabled at (56): [<ffff800008130560>] queue_work_on+0x78/0x15c kernel/workqueue.c:1542
softirqs last  enabled at (42): [<ffff80000b21d8b0>] spin_unlock_bh include/linux/spinlock.h:395 [inline]
softirqs last  enabled at (42): [<ffff80000b21d8b0>] release_sock+0xf4/0x108 net/core/sock.c:3473
softirqs last disabled at (40): [<ffff80000b21d7e8>] spin_lock_bh include/linux/spinlock.h:355 [inline]
softirqs last disabled at (40): [<ffff80000b21d7e8>] release_sock+0x2c/0x108 net/core/sock.c:3460
---[ end trace 0000000000000000 ]---
nci: __nci_request: wait_for_completion_interruptible_timeout failed 0

Crashes (13):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2022/11/29 17:21 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 6d464646530f 05dc7993 .config console log report syz C [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 WARNING in nci_send_cmd
2022/11/25 13:39 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 65762d97e6fa 74a66371 .config console log report syz C [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 WARNING in nci_send_cmd
2022/11/16 15:15 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 9500fc6e9e60 3a127a31 .config console log report syz C [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 WARNING in nci_send_cmd
2022/11/16 08:50 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 9500fc6e9e60 3a127a31 .config console log report syz C [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 WARNING in nci_send_cmd
2022/11/21 19:22 upstream eb7081409f94 f9a97739 .config console log report info ci-qemu2-arm64-mte WARNING in nci_send_cmd
2022/11/16 05:10 upstream 81e7cfa3a9eb bfcab33d .config console log report info ci-qemu2-arm64-mte WARNING in nci_send_cmd
2022/11/29 11:28 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 6d464646530f ca9683b8 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 WARNING in nci_send_cmd
2022/11/25 05:38 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 65762d97e6fa 74a66371 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 WARNING in nci_send_cmd
2022/11/23 12:30 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 65762d97e6fa 75740b3f .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 WARNING in nci_send_cmd
2022/11/19 00:12 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 9500fc6e9e60 5bb70014 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 WARNING in nci_send_cmd
2022/11/18 23:16 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 9500fc6e9e60 5bb70014 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 WARNING in nci_send_cmd
2022/11/16 22:36 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 9500fc6e9e60 3a127a31 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 WARNING in nci_send_cmd
2022/11/16 11:08 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 9500fc6e9e60 3a127a31 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 WARNING in nci_send_cmd
* Struck through repros no longer work on HEAD.