[BUG] general protection fault in phy_ethtool_set_wol

[Farhad Alemi]

Hello,

We are reporting the following crash (reproducer attached):
Linux version 7.3.0-rc2 50d05c7c76c96b90462f24debacca971d2e86713
Build Config: UpstreamAppArmorKASAN (KASAN + UBSAN, panic_on_warn=1)

[   44.382472][ T9491] Oops: general protection fault, probably for
non-canonical address 0xdffffc00000000a2: 0000 [#1] SMP KASAN NOPTI
[   44.383626][ T9491] KASAN: null-ptr-deref in range
[0x0000000000000510-0x0000000000000517]
[   44.384388][ T9491] CPU: 0 UID: 0 PID: 9491 Comm: repro Not tainted
7.3.0-rc2-00099-g50d05c7c76c9 #1 PREEMPT(full)
[   44.385328][ T9491] Hardware name: QEMU Standard PC (Q35 + ICH9,
2009), BIOS 1.17.0-debian-1.17.0-1ubuntu1 04/01/2014
[   44.386283][ T9491] RIP: 0010:phy_ethtool_set_wol+0x31/0x100
[   44.386830][ T9491] Code: 41 56 41 55 41 54 53 48 89 f3 49 89 fe 48
bd 00 00 00 00 00 fc ff df e8 ad 95 2f fb 4d 8d be 10 05 00 00 4d 89
fd 49 c1 ed 03 <41> 80 7c 2d 00 00 74 08 4c 89 ff e8 1f 8f 9f fb 4d 8b
27 4d 85 e4
[   44.388549][ T9491] RSP: 0018:ffffc90006c578c0 EFLAGS: 00010202
[   44.389106][ T9491] RAX: ffffffff869806d3 RBX: ffffc90006c57980
RCX: ffff88802b762640
[   44.389815][ T9491] RDX: 0000000000000000 RSI: ffffc90006c57980
RDI: 0000000000000000
[   44.390574][ T9491] RBP: dffffc0000000000 R08: ffffffff90563d7f
R09: 1ffffffff20ac7af
[   44.391323][ T9491] R10: dffffc0000000000 R11: fffffbfff20ac7b0
R12: ffff8881083a4ec8
[   44.392075][ T9491] R13: 00000000000000a2 R14: 0000000000000000
R15: 0000000000000510
[   44.392874][ T9491] FS:  000000002473c400(0000)
GS:ffff8880d7388000(0000) knlGS:0000000000000000
[   44.393672][ T9491] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   44.394264][ T9491] CR2: 00007f4a539c7238 CR3: 000000010ec32000
CR4: 0000000000752ef0
[   44.394978][ T9491] PKRU: 55555554
[   44.395304][ T9491] Call Trace:
[   44.395613][ T9491]  <TASK>
[   44.395890][ T9491]  lan78xx_set_wol+0x180/0x240
[   44.396335][ T9491]  ethtool_set_wol+0x2cb/0x3f0
[   44.396778][ T9491]  ? __pfx_ethtool_set_wol+0x10/0x10
[   44.397264][ T9491]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[   44.397795][ T9491]  ? _raw_spin_unlock_irqrestore+0x4c/0x80
[   44.398328][ T9491]  dev_ethtool+0x141e/0x29c0
[   44.398751][ T9491]  ? __lock_acquire+0x74c/0x2db0
[   44.399210][ T9491]  ? __pfx_dev_ethtool+0x10/0x10
[   44.399688][ T9491]  ? inet_ioctl+0x484/0x560
[   44.400129][ T9491]  ? lock_acquire+0x115/0x350
[   44.400585][ T9491]  ? dev_load+0x21/0x1f0
[   44.401000][ T9491]  ? dev_load+0x21/0x1f0
[   44.401414][ T9491]  dev_ioctl+0x392/0x1150
[   44.401811][ T9491]  sock_do_ioctl+0x23e/0x320
[   44.402239][ T9491]  ? __pfx_sock_do_ioctl+0x10/0x10
[   44.402706][ T9491]  sock_ioctl+0x5c6/0x7f0
[   44.403213][ T9491]  ? __pfx_sock_ioctl+0x10/0x10
[   44.403679][ T9491]  ? __fget_files+0x2a/0x420
[   44.404149][ T9491]  ? __fget_files+0x3a0/0x420
[   44.404619][ T9491]  ? __fget_files+0x2a/0x420
[   44.405066][ T9491]  ? bpf_lsm_file_ioctl+0x9/0x20
[   44.405549][ T9491]  ? __pfx_sock_ioctl+0x10/0x10
[   44.405996][ T9491]  __se_sys_ioctl+0xfc/0x170
[   44.406420][ T9491]  do_syscall_64+0x155/0x510
[   44.406846][ T9491]  ? trace_irq_disable+0x3b/0x140
[   44.407310][ T9491]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   44.407858][ T9491]  ? clear_bhb_loop+0x30/0x80
[   44.408327][ T9491]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   44.408890][ T9491] RIP: 0033:0x425a5d
[   44.409290][ T9491] Code: 04 25 28 00 00 00 48 89 45 c8 31 c0 48 8d
45 10 c7 45 b0 10 00 00 00 48 89 45 b8 48 8d 45 d0 48 89 45 c0 b8 10
00 00 00 0f 05 <89> c2 3d 00 f0 ff ff 77 1a 48 8b 45 c8 64 48 2b 04 25
28 00 00 00
[   44.411074][ T9491] RSP: 002b:00007ffc17c574d0 EFLAGS: 00000246
ORIG_RAX: 0000000000000010
[   44.411841][ T9491] RAX: ffffffffffffffda RBX: 0000000000000001
RCX: 0000000000425a5d
[   44.412604][ T9491] RDX: 00007ffc17c57560 RSI: 0000000000008946
RDI: 0000000000000004
[   44.413419][ T9491] RBP: 00007ffc17c57520 R08: 00000000000001a0
R09: 000000002473dca0
[   44.414166][ T9491] R10: 00000000000001a0 R11: 0000000000000246
R12: 00007ffc17c577e8
[   44.414919][ T9491] R13: 00007ffc17c577f8 R14: 0000000000000002
R15: 00000000004caa40
[   44.415649][ T9491]  </TASK>
[   44.415954][ T9491] Modules linked in:
[   44.416487][ T9491] ---[ end trace 0000000000000000 ]---
[   44.429798][ T9491] RIP: 0010:phy_ethtool_set_wol+0x31/0x100
[   44.429815][ T9491] Code: 41 56 41 55 41 54 53 48 89 f3 49 89 fe 48
bd 00 00 00 00 00 fc ff df e8 ad 95 2f fb 4d 8d be 10 05 00 00 4d 89
fd 49 c1 ed 03 <41> 80 7c 2d 00 00 74 08 4c 89 ff e8 1f 8f 9f fb 4d 8b
27 4d 85 e4
[   44.429820][ T9491] RSP: 0018:ffffc90006c578c0 EFLAGS: 00010202
[   44.429827][ T9491] RAX: ffffffff869806d3 RBX: ffffc90006c57980
RCX: ffff88802b762640
[   44.429832][ T9491] RDX: 0000000000000000 RSI: ffffc90006c57980
RDI: 0000000000000000
[   44.429837][ T9491] RBP: dffffc0000000000 R08: ffffffff90563d7f
R09: 1ffffffff20ac7af
[   44.429841][ T9491] R10: dffffc0000000000 R11: fffffbfff20ac7b0
R12: ffff8881083a4ec8
[   44.429846][ T9491] R13: 00000000000000a2 R14: 0000000000000000
R15: 0000000000000510
[   44.429850][ T9491] FS:  000000002473c400(0000)
GS:ffff8880d7388000(0000) knlGS:0000000000000000
[   44.429856][ T9491] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   44.429860][ T9491] CR2: 0000555e3ade6018 CR3: 000000010ec32000
CR4: 0000000000752ef0
[   44.429867][ T9491] PKRU: 55555554
[   44.429873][ T9491] Kernel panic - not syncing: Fatal exception
[   44.439990][ T9491] Kernel Offset: disabled
[   44.440533][ T9491] Rebooting in 86400 seconds..

Regards,

Attachment: reproducer.c
Description: Binary data