[BUG] general protection fault in dostream

[Farhad Alemi]

Hello,

We are reporting the following crash (reproducer attached and a
proposed patch forthcoming):
Linux version 7.3.0-rc2 50d05c7c76c96b90462f24debacca971d2e86713
Build Config: UpstreamAppArmorKASAN (KASAN + UBSAN, panic_on_warn=1)

[   44.061617][ T5050] usb 1-1: new high-speed USB device number 2
using dummy_hcd
[   44.222640][ T5050] usb 1-1: New USB device found, idVendor=04cb,
idProduct=0104, bcdDevice= 1.00
[   44.225178][ T5050] usb 1-1: New USB device strings: Mfr=0,
Product=0, SerialNumber=0
[   44.239511][ T5050] gspca_main: finepix-2.14.0 probing 04cb:0104
[   44.321173][ T5050] Oops: general protection fault, probably for
non-canonical address 0xdffffc000000000c: 0000 [#1] SMP KASAN NOPTI
[   44.322340][ T5050] KASAN: null-ptr-deref in range
[0x0000000000000060-0x0000000000000067]
[   44.323096][ T5050] CPU: 1 UID: 0 PID: 5050 Comm: kworker/1:5 Not
tainted 7.3.0-rc2-00099-g50d05c7c76c9 #1 PREEMPT(full)
[   44.324077][ T5050] Hardware name: QEMU Standard PC (Q35 + ICH9,
2009), BIOS 1.17.0-debian-1.17.0-1ubuntu1 04/01/2014
[   44.325031][ T5050] Workqueue: events dostream
[   44.325487][ T5050] RIP: 0010:dostream+0xac/0x990
[   44.325935][ T5050] Code: ff 48 89 d8 48 c1 e8 03 42 80 3c 20 00 74
08 48 89 df e8 47 be 12 fa 48 8b 03 48 89 44 24 40 48 8d 58 60 48 89
d8 48 c1 e8 03 <42> 80 3c 20 00 74 08 48 89 df e8 25 be 12 fa 4c 8b 3b
43 c6 44 26
[   44.327737][ T5050] RSP: 0018:ffffc90002f1f9a0 EFLAGS: 00010206
[   44.328284][ T5050] RAX: 000000000000000c RBX: 0000000000000060
RCX: ffff888106e2cc80
[   44.328994][ T5050] RDX: 0000000000000000 RSI: ffffffff8c4c9260
RDI: ffff888025ff2d28
[   44.329704][ T5050] RBP: ffffc90002f1fad0 R08: ffffffff90563d7f
R09: 1ffffffff20ac7af
[   44.330417][ T5050] R10: dffffc0000000000 R11: ffffffff8824d730
R12: dffffc0000000000
[   44.331143][ T5050] R13: ffff888025ff2d28 R14: 1ffff920005e3f48
R15: ffff88810e04e418
[   44.331929][ T5050] FS:  0000000000000000(0000)
GS:ffff8881da588000(0000) knlGS:0000000000000000
[   44.332724][ T5050] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   44.333313][ T5050] CR2: 00007ffdf8f1cbc8 CR3: 000000010586c000
CR4: 0000000000752ef0
[   44.334030][ T5050] PKRU: 55555554
[   44.334356][ T5050] Call Trace:
[   44.334664][ T5050]  <TASK>
[   44.334943][ T5050]  ? lock_acquire+0x115/0x350
[   44.335392][ T5050]  ? __pfx_dostream+0x10/0x10
[   44.335824][ T5050]  ? process_scheduled_works+0x94e/0x1900
[   44.336348][ T5050]  ? process_scheduled_works+0x94e/0x1900
[   44.336878][ T5050]  ? process_scheduled_works+0x94e/0x1900
[   44.337396][ T5050]  process_scheduled_works+0xc99/0x1900
[   44.337907][ T5050]  ? __pfx_process_scheduled_works+0x10/0x10
[   44.338453][ T5050]  ? assign_work+0x3d5/0x5e0
[   44.338883][ T5050]  worker_thread+0xa53/0xfc0
[   44.339307][ T5050]  kthread+0x38b/0x480
[   44.339688][ T5050]  ? __pfx_worker_thread+0x10/0x10
[   44.340154][ T5050]  ? __pfx_kthread+0x10/0x10
[   44.340578][ T5050]  ret_from_fork+0x514/0xb70
[   44.341011][ T5050]  ? __pfx_ret_from_fork+0x10/0x10
[   44.341546][ T5050]  ? __switch_to+0xc79/0x1410
[   44.341983][ T5050]  ? __pfx_kthread+0x10/0x10
[   44.342407][ T5050]  ret_from_fork_asm+0x1a/0x30
[   44.342856][ T5050]  </TASK>
[   44.343141][ T5050] Modules linked in:
[   44.343610][ T5050] ---[ end trace 0000000000000000 ]---
[   44.353359][ T5050] RIP: 0010:dostream+0xac/0x990
[   44.353371][ T5050] Code: ff 48 89 d8 48 c1 e8 03 42 80 3c 20 00 74
08 48 89 df e8 47 be 12 fa 48 8b 03 48 89 44 24 40 48 8d 58 60 48 89
d8 48 c1 e8 03 <42> 80 3c 20 00 74 08 48 89 df e8 25 be 12 fa 4c 8b 3b
43 c6 44 26
[   44.353377][ T5050] RSP: 0018:ffffc90002f1f9a0 EFLAGS: 00010206
[   44.353384][ T5050] RAX: 000000000000000c RBX: 0000000000000060
RCX: ffff888106e2cc80
[   44.353388][ T5050] RDX: 0000000000000000 RSI: ffffffff8c4c9260
RDI: ffff888025ff2d28
[   44.353393][ T5050] RBP: ffffc90002f1fad0 R08: ffffffff90563d7f
R09: 1ffffffff20ac7af
[   44.353398][ T5050] R10: dffffc0000000000 R11: ffffffff8824d730
R12: dffffc0000000000
[   44.353402][ T5050] R13: ffff888025ff2d28 R14: 1ffff920005e3f48
R15: ffff88810e04e418
[   44.353407][ T5050] FS:  0000000000000000(0000)
GS:ffff8881da588000(0000) knlGS:0000000000000000
[   44.353412][ T5050] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   44.353417][ T5050] CR2: 0000564b412ac2c8 CR3: 000000000e948000
CR4: 0000000000752ef0
[   44.353423][ T5050] PKRU: 55555554
[   44.353429][ T5050] Kernel panic - not syncing: Fatal exception
[   44.363111][ T5050] Kernel Offset: disabled
[   44.363652][ T5050] Rebooting in 86400 seconds..

Regards,
SEFCOM Lab @ ASU

Attachment: reproducer.c
Description: Binary data