Re: [Linux Kernel Bugs] KASAN: slab-use-after-free Read in cec_queue_msg_fh and 4 other crashes in the cec device (`cec_ioctl`)

["Yang, Chenyuan" <cy54@illinois.edu>]

[-- Attachment #1: Type: text/plain, Size: 6465 bytes --]

Hi Hans,

Such timeout logs happen all the time when I execute the C program attached.

```
gcc -pthread repro.c -o exe
./exe
```

The logs are from QEMU:

```
Debian GNU/Linux 11 syzkaller ttyS0

syzkaller login: [  326.705401][   T51] Bluetooth: hci0: sending frame failed (-49)
[  326.707063][ T4466] Bluetooth: hci0: Opcode 0x1003 failed: -49
[  335.945400][ T4466] Bluetooth: hci0: Opcode 0x1003 failed: -110
[  335.945417][   T51] Bluetooth: hci0: command 0x1003 tx timeout
[  390.885042][ T2019] cec-vivid-000-vid-out0: transmit timed out
[  390.894890][ T2050] cec-vivid-002-vid-cap0: transmit timed out
[  390.895540][ T2034] cec-vivid-001-vid-cap0: transmit timed out
[  390.905041][ T2067] cec-vivid-003-vid-out0: transmit timed out
[  392.985033][ T2018] cec-vivid-000-vid-cap0: transmit timed out
...
```

Best,
Chenyuan

On 4/22/24, 10:04 AM, "Hans Verkuil" <hverkuil-cisco@xs4all.nl <mailto:hverkuil-cisco@xs4all.nl>> wrote:


Hi Chenyuan,


My apologies for the delay, I missed your email.


On 26/02/2024 13:27, Yang, Chenyuan wrote:
> Hi Hans,
> 
> Thank you for your continued efforts in investigating this bug and implementing the new patch!
> 
> Regarding the two warnings, they have been addressed by this new patch and are no longer reproducible. Additionally, I conducted a 48-hour fuzzing test on the CEC driver, which has successfully eliminated the previous hanging issue.
> 
> One thing to note that the system will now log timeout events:
> ```
> [ 2281.265385][ T2034] cec-vivid-001-vid-out0: transmit timed out
> [ 2282.994510][ T2017] cec-vivid-000-vid-cap0: transmit timed out
> [ 2283.063484][ T2050] cec-vivid-002-vid-out0: transmit timed out
> [ 2283.073468][ T2065] cec-vivid-003-vid-cap0: transmit timed out
> [ 2283.373518][ T2033] cec-vivid-001-vid-cap0: transmit timed out
> [ 2285.113544][ T2018] cec-vivid-000-vid-out0: transmit timed out
> [ 2285.193502][ T2050] cec-vivid-002-vid-out0: transmit timed out
> [ 2285.193570][ T2065] cec-vivid-003-vid-cap0: transmit timed out
> [ 2285.513570][ T2033] cec-vivid-001-vid-cap0: transmit timed out
> ```


Is this happening all the time, or just once in a (long?) while?


Regards,


Hans


> 
> Best,
> Chenyuan
> 
> From: Hans Verkuil <hverkuil-cisco@xs4all.nl <mailto:hverkuil-cisco@xs4all.nl>>
> Date: Friday, February 23, 2024 at 8:44 AM
> To: Yang, Chenyuan <cy54@illinois.edu <mailto:cy54@illinois.edu>>, linux-media@vger.kernel.org <mailto:linux-media@vger.kernel.org> <linux-media@vger.kernel.org <mailto:linux-media@vger.kernel.org>>, linux-kernel@vger.kernel.org <mailto:linux-kernel@vger.kernel.org> <linux-kernel@vger.kernel.org <mailto:linux-kernel@vger.kernel.org>>
> Cc: jani.nikula@intel.com <mailto:jani.nikula@intel.com> <jani.nikula@intel.com <mailto:jani.nikula@intel.com>>, syzkaller@googlegroups.com <mailto:syzkaller@googlegroups.com> <syzkaller@googlegroups.com <mailto:syzkaller@googlegroups.com>>, mchehab@kernel.org <mailto:mchehab@kernel.org> <mchehab@kernel.org <mailto:mchehab@kernel.org>>, Zhao, Zijie <zijie4@illinois.edu <mailto:zijie4@illinois.edu>>, Zhang, Lingming <lingming@illinois.edu <mailto:lingming@illinois.edu>>
> Subject: Re: [Linux Kernel Bugs] KASAN: slab-use-after-free Read in cec_queue_msg_fh and 4 other crashes in the cec device (`cec_ioctl`)
> Hi Chenyuan,
> 
> Here is another patch for you to try. I think it is good for blocking CEC_ADAP_S_LOG_ADDRS
> ioctl calls, but if the filehandle is in non-blocking mode, I'm still not certain it
> is correct. But one issue at a time :-)
> 
> Regards,
> 
> Hans
> 
> diff --git a/drivers/media/cec/core/cec-adap.c b/drivers/media/cec/core/cec-adap.c
> index 559a172ebc6c..a493cbce2456 100644
> --- a/drivers/media/cec/core/cec-adap.c
> +++ b/drivers/media/cec/core/cec-adap.c
> @@ -936,8 +936,7 @@ int cec_transmit_msg_fh(struct cec_adapter *adap, struct cec_msg *msg,
> */
> mutex_unlock(&adap->lock);
> wait_for_completion_killable(&data->c);
> - if (!data->completed)
> - cancel_delayed_work_sync(&data->work);
> + cancel_delayed_work_sync(&data->work);
> mutex_lock(&adap->lock);
> 
> /* Cancel the transmit if it was interrupted */
> @@ -1575,9 +1574,12 @@ static int cec_config_thread_func(void *arg)
> */
> static void cec_claim_log_addrs(struct cec_adapter *adap, bool block)
> {
> - if (WARN_ON(adap->is_configuring || adap->is_configured))
> + if (WARN_ON(adap->is_claiming_log_addrs ||
> + adap->is_configuring || adap->is_configured))
> return;
> 
> + adap->is_claiming_log_addrs = true;
> +
> init_completion(&adap->config_completion);
> 
> /* Ready to kick off the thread */
> @@ -1592,6 +1594,7 @@ static void cec_claim_log_addrs(struct cec_adapter *adap, bool block)
> wait_for_completion(&adap->config_completion);
> mutex_lock(&adap->lock);
> }
> + adap->is_claiming_log_addrs = false;
> }
> 
> /*
> diff --git a/drivers/media/cec/core/cec-api.c b/drivers/media/cec/core/cec-api.c
> index 67dc79ef1705..3ef915344304 100644
> --- a/drivers/media/cec/core/cec-api.c
> +++ b/drivers/media/cec/core/cec-api.c
> @@ -178,7 +178,7 @@ static long cec_adap_s_log_addrs(struct cec_adapter *adap, struct cec_fh *fh,
> CEC_LOG_ADDRS_FL_ALLOW_RC_PASSTHRU |
> CEC_LOG_ADDRS_FL_CDC_ONLY;
> mutex_lock(&adap->lock);
> - if (!adap->is_configuring &&
> + if (!adap->is_claiming_log_addrs && !adap->is_configuring &&
> (!log_addrs.num_log_addrs || !adap->is_configured) &&
> !cec_is_busy(adap, fh)) {
> err = __cec_s_log_addrs(adap, &log_addrs, block);
> @@ -664,6 +664,8 @@ static int cec_release(struct inode *inode, struct file *filp)
> list_del_init(&data->xfer_list);
> }
> mutex_unlock(&adap->lock);
> +
> + mutex_lock(&fh->lock);
> while (!list_empty(&fh->msgs)) {
> struct cec_msg_entry *entry =
> list_first_entry(&fh->msgs, struct cec_msg_entry, list);
> @@ -681,6 +683,7 @@ static int cec_release(struct inode *inode, struct file *filp)
> kfree(entry);
> }
> }
> + mutex_unlock(&fh->lock);
> kfree(fh);
> 
> cec_put_device(devnode);
> diff --git a/include/media/cec.h b/include/media/cec.h
> index 10c9cf6058b7..cc3fcd0496c3 100644
> --- a/include/media/cec.h
> +++ b/include/media/cec.h
> @@ -258,6 +258,7 @@ struct cec_adapter {
> u16 phys_addr;
> bool needs_hpd;
> bool is_enabled;
> + bool is_claiming_log_addrs;
> bool is_configuring;
> bool must_reconfigure;
> bool is_configured;
> 






[-- Attachment #2: repro.c --]
[-- Type: application/octet-stream, Size: 8130 bytes --]

// autogenerated by syzkaller (https://github.com/google/syzkaller)

#define _GNU_SOURCE 

#include <dirent.h>
#include <endian.h>
#include <errno.h>
#include <fcntl.h>
#include <pthread.h>
#include <signal.h>
#include <stdarg.h>
#include <stdbool.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/prctl.h>
#include <sys/stat.h>
#include <sys/syscall.h>
#include <sys/types.h>
#include <sys/wait.h>
#include <time.h>
#include <unistd.h>

#include <linux/futex.h>

static unsigned long long procid;

static void sleep_ms(uint64_t ms)
{
	usleep(ms * 1000);
}

static uint64_t current_time_ms(void)
{
	struct timespec ts;
	if (clock_gettime(CLOCK_MONOTONIC, &ts))
	exit(1);
	return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000;
}

static void thread_start(void* (*fn)(void*), void* arg)
{
	pthread_t th;
	pthread_attr_t attr;
	pthread_attr_init(&attr);
	pthread_attr_setstacksize(&attr, 128 << 10);
	int i = 0;
	for (; i < 100; i++) {
		if (pthread_create(&th, &attr, fn, arg) == 0) {
			pthread_attr_destroy(&attr);
			return;
		}
		if (errno == EAGAIN) {
			usleep(50);
			continue;
		}
		break;
	}
	exit(1);
}

typedef struct {
	int state;
} event_t;

static void event_init(event_t* ev)
{
	ev->state = 0;
}

static void event_reset(event_t* ev)
{
	ev->state = 0;
}

static void event_set(event_t* ev)
{
	if (ev->state)
	exit(1);
	__atomic_store_n(&ev->state, 1, __ATOMIC_RELEASE);
	syscall(SYS_futex, &ev->state, FUTEX_WAKE | FUTEX_PRIVATE_FLAG, 1000000);
}

static void event_wait(event_t* ev)
{
	while (!__atomic_load_n(&ev->state, __ATOMIC_ACQUIRE))
		syscall(SYS_futex, &ev->state, FUTEX_WAIT | FUTEX_PRIVATE_FLAG, 0, 0);
}

static int event_isset(event_t* ev)
{
	return __atomic_load_n(&ev->state, __ATOMIC_ACQUIRE);
}

static int event_timedwait(event_t* ev, uint64_t timeout)
{
	uint64_t start = current_time_ms();
	uint64_t now = start;
	for (;;) {
		uint64_t remain = timeout - (now - start);
		struct timespec ts;
		ts.tv_sec = remain / 1000;
		ts.tv_nsec = (remain % 1000) * 1000 * 1000;
		syscall(SYS_futex, &ev->state, FUTEX_WAIT | FUTEX_PRIVATE_FLAG, 0, &ts);
		if (__atomic_load_n(&ev->state, __ATOMIC_ACQUIRE))
			return 1;
		now = current_time_ms();
		if (now - start > timeout)
			return 0;
	}
}

static bool write_file(const char* file, const char* what, ...)
{
	char buf[1024];
	va_list args;
	va_start(args, what);
	vsnprintf(buf, sizeof(buf), what, args);
	va_end(args);
	buf[sizeof(buf) - 1] = 0;
	int len = strlen(buf);
	int fd = open(file, O_WRONLY | O_CLOEXEC);
	if (fd == -1)
		return false;
	if (write(fd, buf, len) != len) {
		int err = errno;
		close(fd);
		errno = err;
		return false;
	}
	close(fd);
	return true;
}

static long syz_open_dev(volatile long a0, volatile long a1, volatile long a2)
{
	if (a0 == 0xc || a0 == 0xb) {
		char buf[128];
		sprintf(buf, "/dev/%s/%d:%d", a0 == 0xc ? "char" : "block", (uint8_t)a1, (uint8_t)a2);
		return open(buf, O_RDWR, 0);
	} else {
		char buf[1024];
		char* hash;
		strncpy(buf, (char*)a0, sizeof(buf) - 1);
		buf[sizeof(buf) - 1] = 0;
		while ((hash = strchr(buf, '#'))) {
			*hash = '0' + (char)(a1 % 10);
			a1 /= 10;
		}
		return open(buf, a2, 0);
	}
}

static void kill_and_wait(int pid, int* status)
{
	kill(-pid, SIGKILL);
	kill(pid, SIGKILL);
	for (int i = 0; i < 100; i++) {
		if (waitpid(-1, status, WNOHANG | __WALL) == pid)
			return;
		usleep(1000);
	}
	DIR* dir = opendir("/sys/fs/fuse/connections");
	if (dir) {
		for (;;) {
			struct dirent* ent = readdir(dir);
			if (!ent)
				break;
			if (strcmp(ent->d_name, ".") == 0 || strcmp(ent->d_name, "..") == 0)
				continue;
			char abort[300];
			snprintf(abort, sizeof(abort), "/sys/fs/fuse/connections/%s/abort", ent->d_name);
			int fd = open(abort, O_WRONLY);
			if (fd == -1) {
				continue;
			}
			if (write(fd, abort, 1) < 0) {
			}
			close(fd);
		}
		closedir(dir);
	} else {
	}
	while (waitpid(-1, status, __WALL) != pid) {
	}
}

static void setup_test()
{
	prctl(PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0);
	setpgrp();
	write_file("/proc/self/oom_score_adj", "1000");
}

struct thread_t {
	int created, call;
	event_t ready, done;
};

static struct thread_t threads[16];
static void execute_call(int call);
static int running;

static void* thr(void* arg)
{
	struct thread_t* th = (struct thread_t*)arg;
	for (;;) {
		event_wait(&th->ready);
		event_reset(&th->ready);
		execute_call(th->call);
		__atomic_fetch_sub(&running, 1, __ATOMIC_RELAXED);
		event_set(&th->done);
	}
	return 0;
}

static void execute_one(void)
{
	int i, call, thread;
	for (call = 0; call < 4; call++) {
		for (thread = 0; thread < (int)(sizeof(threads) / sizeof(threads[0])); thread++) {
			struct thread_t* th = &threads[thread];
			if (!th->created) {
				th->created = 1;
				event_init(&th->ready);
				event_init(&th->done);
				event_set(&th->done);
				thread_start(thr, th);
			}
			if (!event_isset(&th->done))
				continue;
			event_reset(&th->done);
			th->call = call;
			__atomic_fetch_add(&running, 1, __ATOMIC_RELAXED);
			event_set(&th->ready);
			event_timedwait(&th->done, 50);
			break;
		}
	}
	for (i = 0; i < 100 && __atomic_load_n(&running, __ATOMIC_RELAXED); i++)
		sleep_ms(1);
}

static void execute_one(void);

#define WAIT_FLAGS __WALL

static void loop(void)
{
	int iter = 0;
	for (;; iter++) {
		int pid = fork();
		if (pid < 0)
	exit(1);
		if (pid == 0) {
			setup_test();
			execute_one();
			exit(0);
		}
		int status = 0;
		uint64_t start = current_time_ms();
		for (;;) {
			if (waitpid(-1, &status, WNOHANG | WAIT_FLAGS) == pid)
				break;
			sleep_ms(1);
			if (current_time_ms() - start < 5000)
				continue;
			kill_and_wait(pid, &status);
			break;
		}
	}
}

uint64_t r[2] = {0xffffffffffffffff, 0xffffffffffffffff};

void execute_call(int call)
{
		intptr_t res = 0;
	switch (call) {
	case 0:
memcpy((void*)0x20000500, "/dev/cec#\000", 10);
		res = -1;
res = syz_open_dev(/*dev=*/0x20000500, /*id=*/0 + procid*1, /*flags=*/0x200);
		if (res != -1)
				r[0] = res;
		break;
	case 1:
*(uint64_t*)0x20000740 = 0x3b;
*(uint64_t*)0x20000748 = 9;
*(uint32_t*)0x20000750 = 2;
*(uint32_t*)0x20000754 = 0x71f;
*(uint32_t*)0x20000758 = 0x1ff;
*(uint32_t*)0x2000075c = 6;
memcpy((void*)0x20000760, "\x6b\x8d\xaf\x4b\x76\x11\x49\x84\xb4\x49\x50\x33\x72\x2f\x04\x2f", 16);
*(uint8_t*)0x20000770 = 0x1f;
*(uint8_t*)0x20000771 = 8;
*(uint8_t*)0x20000772 = 4;
*(uint8_t*)0x20000773 = 3;
*(uint8_t*)0x20000774 = 6;
*(uint8_t*)0x20000775 = 0x80;
*(uint8_t*)0x20000776 = 0xcb;
		syscall(__NR_ioctl, /*fd=*/r[0], /*cmd=*/0xc0386105, /*arg=*/0x20000740ul);
		break;
	case 2:
memcpy((void*)0x20000000, "/dev/cec#\000", 10);
		res = -1;
res = syz_open_dev(/*dev=*/0x20000000, /*id=*/0 + procid*1, /*flags=*/0xa0882);
		if (res != -1)
				r[1] = res;
		break;
	case 3:
memcpy((void*)0x20000200, "\xea\xe6\x74\x80", 4);
*(uint16_t*)0x20000204 = 0xd7;
*(uint8_t*)0x20000206 = 6;
*(uint8_t*)0x20000207 = 0x81;
*(uint32_t*)0x20000208 = 1;
*(uint32_t*)0x2000020c = 0x7c;
memcpy((void*)0x20000210, "\xa1\x85\x8f\x9c\x86\xd5\xbf\x22\x7d\x1e\x21\x7d\xb1\x02\x0e", 15);
memcpy((void*)0x2000021f, "\xc3\x5e\x62\x15", 4);
memcpy((void*)0x20000223, "\x35\x9f\x8a\x79", 4);
memcpy((void*)0x20000227, "\x7a\xa9\xc6\xef", 4);
memcpy((void*)0x2000022b, "\x74\x37\x30\x15\x41\x4e\x64\x8a\x54\x8f\x1d\x53", 12);
memcpy((void*)0x20000237, "\x69\xba\x77\x07\x0a\x3a\x7e\x8f\xf3\x50\xdc\xba", 12);
memcpy((void*)0x20000243, "\x2f\xf4\x1f\x2c\x96\x91\xa9\x6e\xc2\x0e\x56\x0b", 12);
memcpy((void*)0x2000024f, "\x6c\x57\xba\x1a\xad\x2d\xc6\x88\x02\x80\xda\x9f", 12);
		syscall(__NR_ioctl, /*fd=*/r[1], /*cmd=*/0xc05c6104, /*arg=*/0x20000200ul);
		break;
	}

}
int main(void)
{
		syscall(__NR_mmap, /*addr=*/0x1ffff000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=*/0x32ul, /*fd=*/-1, /*offset=*/0ul);
	syscall(__NR_mmap, /*addr=*/0x20000000ul, /*len=*/0x1000000ul, /*prot=*/7ul, /*flags=*/0x32ul, /*fd=*/-1, /*offset=*/0ul);
	syscall(__NR_mmap, /*addr=*/0x21000000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=*/0x32ul, /*fd=*/-1, /*offset=*/0ul);
	for (procid = 0; procid < 8; procid++) {
		if (fork() == 0) {
			loop();
		}
	}
	sleep(1000000);
	return 0;
}