[BUG] ath10k: WARNING in ath10k_pci_probe on an unmatched device

[CJ <firefly0158@163.com>]

Hi,


I am reporting an issue triggered by a syzkaller reproducer on Linux
7.3.0-rc2. The issue is reproducible with HEAD commit
df2908090cda368b01ff43709f51890076c56157.


The reproducer mounts sysfs, sets the driver_override of PCI device
0000:00:01.0 to ath10k_pci, and then writes that device's name into the
ath10k_pci bind attribute. That forces the driver to probe a device it was
never matched against, so the device is not a real ath10k radio.


In ath10k_pci_probe(), the driver reads the chip version from the device and
selects behaviour with a switch over that value. No case matches, so the
default branch executes WARN_ON(1) and the probe returns -EOPNOTSUPP. The
warning comes from the task performing the sysfs write, through bind_store()
-> device_driver_attach() -> really_probe().


This is a driver being asked to drive hardware it does not recognise. The
warning is informative rather than a memory-safety problem, but since the
bind attribute is writable by root and the device can be any PCI function,
returning the error without the WARN_ON would avoid the splat. I have not
checked whether the version register read itself is valid for this device.


This failure was reported earlier against the linux-6.1 longterm series at
https://syzkaller.appspot.com/bug?extid=31ec6bc3a92b8aa9f2f7, and the
reproducer below is the one from that report. It still reproduces on the
tested mainline kernel.


Reproducer:


syz reproducer:
The reproducer is the program below, which requires no large encoded image:


mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/pci/devices/0000:00:01.0/driver_override\x00', 0x1, 0x0)
write(r0, &(0x7f00000000c0)='ath10k_pci\x00', 0xb)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/pci/drivers/ath10k_pci/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000140)='0000:00:01.0\x00', 0xd)


console output: https://pastebin.com/raw/BgzzjVAB
kernel config: https://syzkaller.appspot.com/text?tag=KernelConfig&x=31dfefc4a14efea3


Kernel:


HEAD commit: df2908090cda368b01ff43709f51890076c56157
git tree: mainline
kernel version: 7.3.0-rc2
tested tag: v7.3-rc2 (annotated tag object 5e036ce12de91c6fd674dad33b169c6150be2a7a)


Let me know if you need more details or testing.


Best regards,
Changjian Liu